Re:Why Static Websites Need HTTPS
by icebraining on Tuesday August 28, 2018 @06:58PM
(#17863667)
You can't "spoof" a cert, that's its whole point. If you create a new, it won't have a valid signature, and if you copy the original, you won't have the associated private key to create valid responses.
[ Parent
| on HN ]
Re:Why Static Websites Need HTTPS
by austincheney on Tuesday August 28, 2018 @08:17PM
(#17864089)
https://www.computerworld.com/article/2897815/microsoft-blac...
To be more clear a malicious website can rely on fraudulently issued certificates to validate a spoofed domain. This is a bad cert that appears to be valid and establishes the same level of trust. That is why revocation lists and OCSP are necessary.