3 ms·
Unless malicious JS is served in place of the <keygen> element, which would be largely undetectable to the user.
by antsar 12y ago
Unless malicious JS is served in place of the <keygen> element, which would be largely undetectable to the user.
- kelnos 12y agoHow would said malicious JS then install the generated phony certificate in your browser's cert store?
- antsar 12y agoI'm talking about the step where StartSSL generates an SSL private key for you in the browser (unless you know to click "Skip"). No need to install anything in a browser store, it just brings you to a page with a generated SSL certificate using that key.