3 ms·
> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute
by itistoday2 12y ago
> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system.
Indeed, and the blockchain (combined with a proxy like DNSChain), can be used to do this securely and for free at-scale.
> Encrypted, authenticated: little padlock.
Neither self-signed nor CA-signed certificates are securely authenticated, so the padlock is completely misleading.
See this comment for details: https://news.ycombinator.com/item?id=7826443 https://news.ycombinator.com/item?id=7826443
- itistoday2 12y agoCould whoever down-voted that please explain why you did so?
- tombrossman 12y agoWasn't me but I wonder about this: "Neither self-signed nor CA-signed certificates are securely authenticated...". I'm no expert on CAs but saying their certs are not securely authenticated is worrying. Seems to defeat their purpose, no? Maybe expand on that point if you can as I don't understand how it can be true.
- itistoday2 12y agoDid you read the comment I linked to where I provided those details? Here it is again: https://news.ycombinator.com/item?id=7826443 https://news.ycombinator.com/item?id=7826443 And if you want a longer version of that, you can go here: http://blog.okturtles.com/2014/02/introducing-the-dotdns-metatld/ http://blog.okturtles.com/2014/02/introducing-the-dotdns-met... > I'm no expert on CAs but saying their certs are not securely authenticated is worrying. Yes. I'm glad we agree on that. :P