Timeline for Self-signed cert - how it works
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 30, 2017 at 10:39 | vote | accept | Noob | ||
| Jan 30, 2017 at 10:39 | |||||
| Jan 19, 2017 at 14:36 | vote | accept | Noob | ||
| Jan 30, 2017 at 10:38 | |||||
| Feb 20, 2016 at 0:30 | comment | added | Bacon Brad | @noob You can get a better idea of how a browser would go around treating certificates by reading Chrome's root CA policy. As you can see they take trusted CA's pretty seriously. So anything not a trusted CA (like a self signed certs) are most definitely going to be skeptical to the browser until the user tells them differently. - chromium.org/Home/chromium-security/root-ca-policy | |
| Feb 20, 2016 at 0:27 | comment | added | Bacon Brad | @noob Most browsers use the OS's root certificate store. But they might match those against their own store to see if they are still trustable. If not the browser will still let you visit it but it will ask you if you wish to trust it first (add an exception). Your self signed cert will most definitely get flagged until you add an exception. You can even make and install your own root CA, client cert, and server cert (corporate networks/applications for example) and the browser will still ask for an exception. This doesn't prevent, but it does help fight against malicious certs. | |
| Jan 19, 2016 at 14:46 | comment | added | Noob | thanks for your reply. for 1) a self signed cert uses my own generate private key to sign itself. So do you mean that when presenting this cert to a web client, the client is not going to require any public key for verification of the signature. It is "going to" trust the cert and use the cert directly without verifying the digital signature right ? | |
| Jan 19, 2016 at 12:51 | review | First posts | |||
| Jan 19, 2016 at 12:53 | |||||
| Jan 19, 2016 at 12:50 | history | answered | grin | CC BY-SA 3.0 |