6 ms·

Can you really trust the CAs? There have been many cases where a CA was compromised or tricked into signing fraudulent certs, never mind government mandated bac

• ivanr 13y ago
  It's all matter of risk assessment, which will depend on what your security requirements. Trust that they won't issue an interception certificate when a government agency asks them (with a warrant)? No. But, if you choose a well-established CA, I believe that the risk of fraudulent certificate is small enough to be accepted. Besides, how many cases of fraudulent certificates have been there? Very few actually, relatively speaking, when measured against millions of issued certificates every year. The current arrangements where CAs are able to issue certificates for arbitrary sites without owners' consent is clearly unsatisfactory. Hopefully we'll get key pinning abilities one day to improve the situation. At the end of the day, security is hard. The arrangement with public CAs is flawed, but we don't yet have a better solution that scales. For small (close) groups, a private CA with manual user pinning should work well enough, when deployed with HTTP Strict Transport Security.