3 ms·
> You have to purchase TLS certificates from one of several certificate authorities I'd like to stop this misconception. You don't buy certificates. You make
by rakoo 13y ago
> You have to purchase TLS certificates from one of several certificate authorities
I'd like to stop this misconception. You don't buy certificates. You make your own certificate, which is unknown to the world, and _then_ you buy a stamp from a trusted third-party on your own certificate, so everyone can trust it.
The crux of the matter is whether you can actually trust these third-parties.
- rikacomet 13y agoThe point is, which third parties to trust and for how long? How to be sure always that they are worthy of the continued trust?
- nly 13y agoThat's not accurate. You send them a 'Certificate Signing Request', which is a request for them to issue you with a certificate. It's not a complete certificate template just lacking a signature. In any case... semantically a certificate isn't a certificate until it's been certified, it's just meaningless paper. In some ways this reminds me of the misconception about birth (and marriage) certificates from people new to genealogy. In the UK a birth certificate is just a piece of paper that contains markers of authentication to ensure people who read it can trust that it's true likeness of a record held at Her Majesty's GRO. It doesn't provide any guarantees about the honesty of data itself, or even if the person was ever born, in the same way me reading an x509 doesn't guarantee the data it contains is factual or was issued to the right person. Even if a CA does these checks, there's no way to insert a proof of such in to a certificate, therefore the certificate isn't such a proof...