thehairyone

3 ms·

1. 1.▲
   by thehairyone 11y ago

   @pfg: I know exactly how CAs work. I've built several. Wosign does not issue a cert without an email verification. You can look on their website. There's a nice big box to enter an email address to verify your domain and get the
2. 2.▲
   by thehairyone 11y ago

   Of course the cross signed cert works! That not the point. The cross signature is worthless if the signed cert beneath it is self-signed. If Identrust cross signed self signed certs, the self signed cert would be trusted too... and it would
3. 3.▲
   by thehairyone 11y ago

   Oh yeah! sure... what exactly ensures that the DV cert is a DV cert?
4. 4.▲
   by thehairyone 11y ago

   The cross sign is too far up the chain. If you cross sign a self-signed cert what do you get? A Let's Encrypt Cert. Domain Ownership is not the same as file ownership.
5. 5.▲
   by thehairyone 11y ago

   No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.
6. 6.▲
   by thehairyone 11y ago

   a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-t