You have a moral obligation to use crypto

Re:You have a moral obligation to use crypto by eliasmacpherson on Wednesday February 12, 2014 @05:43AM (#7223584)

I assume the certs are delivered over ssl from the CA to the client requesting the webserver, is that the case?

[ Parent | on HN ]

Re:You have a moral obligation to use crypto by Karunamon on Wednesday February 12, 2014 @10:28AM (#7224770)

When you hit an SSL site, the remote server (the one you're browsing) presents a number of certificates. One for the actual secure domain, and one or more for the CA that signed that certificate (sometimes more than one because the CA's have intermediate keys. A key which signed a key which signed... etc)

The CA itself is not a party to this exchange, they only provide the end product - a signed certificate.

If you trust the CA (in your browser config), you also trust by extension every certificate that CA has ever signed (barring revocation lists).

[ Parent | on HN ]

Re:You have a moral obligation to use crypto by eliasmacpherson on Wednesday February 12, 2014 @11:53AM (#7225392)

Thanks for the explanation, I was under the mistaken impression that communication took place between the CA every time a server was visited.

[ Parent | on HN ]