Tag Info

New answers tagged

1

Trying to focus on the second question. The issue of «Which default trusted root certificates should I remove?» depends basically on who you deal with. You will "only" need to trust all the CAs that sign any of the websites you connect to. For a grandma-type user that always visits the same few sites, probably a handful CAs will be enough, while the list ...


2

The chain is not verified "by itself". A given system (say, a Web browser) will consider a server's certificate as valid because it could build a valid chain (with all signatures corrects and matching names and all the rules of X.509) which ends with the certificate to validate (the server's certificate), and starting with a root CA that the client already ...


2

There are lots of flaws with the current PKI, and trust chain is one of them, but not the only one and not in all cases. Each browser/OS comes with lots of CAs and the trust is enabled by default. So once you get the browser you implicitly trust all these CAs for your communication. You need to explicitly disable trust settings if you want to control whom ...


2

I would not call it blind trusting, but yes - you rely on the trustworthiness of the root certificate and all the intermediate authorities on the way depending on the implementation and configuration. A website's certificate is verified with a CA. In order to make sure this CA is indeed the actual CA you intend to trust, you can verify its own certificate ...



Top 50 recent answers are included