News for hackers. Stuff that matters.

A comment on Certificates for localhost. Parent comment

Re:Certificates for localhost by progval on Wednesday June 20, 2018 @08:18PM (#17361078)
They get one private key per user, and send it to the client's device.
[ Parent | on HN ]
Re:Certificates for localhost by BillinghamJ on Saturday June 23, 2018 @08:19AM (#17380922)
The private key is generated on the client side, and signed by the certificate. Plex has an intermediate which they control to issue these. It would not pass normal validation processes.
[ Parent | on HN ]
Re:Certificates for localhost by ajnin on Thursday June 21, 2018 @08:08AM (#17364339)
Which "compromises" the key, according to current Certificate Authorities policies. Once again the problem boils down to CAs being the sole "anchors of trust" in the current certificate system.
[ Parent | on HN ]
Re:Certificates for localhost by progval on Friday June 22, 2018 @08:10PM (#17378588)
Then they could have their server tunnel ACME challenges to the device, so the private key never leaves the device, but can still be signed.
[ Parent | on HN ]