Viable way to authenticate certificate without a web of trust?

Question

For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the certificate information is really about the owner without a CA? It's not an option to distribute keys in advance.

So far I came up with one-time passwords after an handshake making sure that it's for the purpose to send this OTP. Which will have to be sent back through a medium that allows verification, such as texting from a known cellphone number.

Are there any other methods?

Edit: This question was not specific and had terminology mixed around, which resulted in a good practice to counter this. If you are interested in my original question it's been reformulated here: Authentication methods without trusting 3rd parties unless explicitly indicated

Answer 1

This is a bit muddled. SSL certificates do not use web-of-trust; they use certificate authorities (CAs). Basically, the CAs vouch that the public key for www.example.com is such-and-such. The web-of-trust model is used by PGP, and is intended as an alternative to CAs. So, if you want certificates without CAs, you could look at how the web-of-trust model works -- but beware, it's not clear that it works very well in practice.

It sounds like you want to somehow do without CAs. OK. So what properties do you want your certificates to vouch for? Basically, think of a certificate as a signed statement: "I promise that the public key for www.example.com is 0xD6EF...1E2, signed, Verisign". When relying parties receive this kind of certificate, that statement tells them what they can rely upon. In your new world, what do you want recipients to be able to rely upon? And, if you don't want to have a Verisign present, who is going to verify that those promises are in fact true?

In short, I suggest you think about what you are trying to achieve and what security guarantees you are looking for -- then we can talk about how to achieve them without CAs. Try to write down what you want recipients to be able to rely upon (ignoring the crypto), and who will be responsible for verifying those things are true, and then we can look at the technology.