Comment on Let's Encrypt is 10 years old today !
treadful@lemmy.zip 2 months agoCorrect me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.
The impact is serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.
It doesn’t improve encryption compared to a self-signed cert though.
xthexder@l.sw0.com 2 months ago
If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively MITM for any certificate. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is very common now)