Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #28540 > unrolled thread

Re: I wish I understood SSL Certificates better when they ask

Back to article view | Back to alt.os.linux

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: I wish I understood SSL Certificates better when they ask Peter Pearson <pkpearson@nowhere.invalid> - 2015-06-13 17:17 +0000

#28540 — Re: I wish I understood SSL Certificates better when they ask

On Sat, 13 Jun 2015 05:42:43 +0000 (UTC), Werner Obermeier wrote:
[snip]
>
> Also, how does the *new* certificate get to me?

While your browser is negotiating the secure session with the server,
the server sends the new certificate, including a signature of the
new certificate by some certificate authority (CA).  If that CA isn't
a generally recognized top-level CA, the server also sends *another*
certificate certifying that CA's public key, signed by a higher-level
CA, . . . hoping ultimately to end up with a signature by a CA whose
public key appears in the root-certificate database on your computer.

Which just leads to the question of how your "root-cert" database
gets maintained.  I don't know, but I suspect it gets installed along
with your browser.  Your browser will probably allow you to inspect it
and edit it, which you will probably find very interesting, because
in my experience it includes many third-world governmental authorities
whose certification of the security of your connection to your bank
you would not find comforting at all.

(Think about it: If you were logging into bankofamerica.com, and you
happened to look at the certificate chain (Security / View Certificate /
Details) and saw that it was rooted in the certificate of the
Lower Slobbovian Post Office, would you trust that connection?)

-- 
To email me, substitute nowhere->runbox, invalid->com.

[toc] | [standalone]

Back to top | Article view | alt.os.linux

csiph-web