Reputation
7,502
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 18 36
Newest
 Nice Answer
Impact
~1.1m people reached

Apr
12
comment Are all SSL Certificates equal?
@LieRyan, indeed, that's why I linked to this answer I wrote a while ago too. The main problem is that they mix all this explanation with the number of bits used for the encryption... (and it looks like this particular CA only offers RSA certs according to its CSR guide and other documents). I think what Pacerier and I were talking about was the fact that this overall confusion was often misleading and unhealthy.
Apr
12
comment Are all SSL Certificates equal?
Besides this DV/OV/EV issue, some CAs also seem to maintain some technical confusion around what they're promoting and what actually enforces security, for example RapidSSL's FAQ "the encryption level is determined by the capability of the [...] SSL certificate, [...]", which is obvioulsy not quite true (assuming you have a cert with the right key type anyway, but that's easy enough).
Apr
12
comment Are all SSL Certificates equal?
@Pacerier Yes, that's quite possible. It's true there can be issues with DV certs, but the vested interest these CAs have in selling you more expensive EV certs, along with the fact that they've somehow managed to get themselves hard-coded in the browser's code makes them clearly biased unfortunately.
Apr
12
comment What are the advantages of EV Certificate?
@Pacerier You're right, it is green now, it was blue then... (See for example: support.mozilla.org/en-US/questions/900744 or screenshots at support.hostgator.com/articles/ssl-certificates/ssl-setup-use/… ). The latest rules are here for Firefox: support.mozilla.org/en-US/kb/…
Mar
23
awarded  Nice Answer
Mar
18
revised What's the point of the CA?
added 145 characters in body
Mar
18
answered What's the point of the CA?
Mar
17
comment What's the point of the CA?
I'm not sure the current duplicate target question "How does SSL/TLS work?" really is a duplicate of this question. This question is quite specifically about CAs (which may or may not have anything to do with SSL/TLS, e.g. S/MIME or code signing). That said, there are already a few other questions that would be quite close to the topic of this question, e.g. here, here (just a few I can remember, I'm sure there's more).
Feb
28
comment What certificates are needed for multi-level subdomains?
@voutasaurus As far as I know, this is still valid (RFC 6125 has not even been fully implemented in all clients). I don't think anyone tried to consider multiple wildcard levels as a feature to add to any spec.
Feb
17
awarded  Generalist
Jan
9
awarded  Guru
Jan
7
awarded  Good Answer
Dec
24
comment How do I check that I have a direct SSL connection to a website?
@EloyRoldánParedes Sure, but that's why I said it's "roughly" equivalent to IP routing proxy. Having or not having the host name is a little different indeed, but in terms of protection this is very similar since someone in a routing proxy position can often work out the hostname (with some element of traffic inspection indeed not needed with HTTP CONNECT), either via SNI (or by DNS lookup or querying the cert themselves, when SNI is not used). I'd still put them in the same broad category, compared with the other two proxy types.
Dec
23
comment How do I check that I have a direct SSL connection to a website?
@EloyRoldánParedes No, with HTTP CONNECT, you only give the host and port you're going to connect to, not the URL (See RFC 2817 Section 5.2: "The Request-URI portion of the Request-Line is always an 'authority' as defined by URI Generic Syntax [2], which is to say the host name and port number destination of the requested connection separated by a colon".
Dec
14
awarded  Good Answer
Nov
3
awarded  Good Answer
Sep
12
awarded  Necromancer
Aug
20
awarded  Autobiographer
May
13
awarded  Yearling
May
1
comment Why is a public key called a key - isn't it a lock?
There some subtlety in the English language here. Some of the other uses of the word key could be translated with different words in other languages, because they represent rather different concepts. The vast majority of documents talking about encryption represent key in the "key+lock" sense, often with accompanying pictures. I've never seen a document about encryption illustrated with a piano, musical or map type of key.