4 ms·
Why the hate for self-signed certificates? I would personally rather see those promoted and methods developed to securely bootstrap them than make us all relia
by zmmmmm 12y ago
Why the hate for self-signed certificates?
I would personally rather see those promoted and methods developed to securely bootstrap them than make us all reliant on centralised CA infrastructure. The centralised CAs are all at the mercy of their governments and hence, in my opinion, ought to be considered almost as insecure as self-signed certs.
EDIT: I think I misunderstood your comment - reading again it sounds like you are also in favour of self-signed (hopefully so).
- talideon 12y agoUntil supports for DANE and DNSSEC becomes widespread, unless it's a site for personal use, self-signed certs can't really be trusted by third parties. (BTW, if you're not using a conventional CA, you'd best off being your own CA, and signing your certs with a CA certificate you've generated rather than simply self-signing the cert. It's a little more trouble in the short term, but it means that each time you subsequently need to generate a new cert, you don't need to put up with warnings everywhere because it'll be validated by your own CA cert. The downside of this is having to install the CA cert everywhere. That's what I do for my private stuff. There are tonnes of tutorials online on how to do it.)