0

I was reading about digital signatures and certificates and from what I've read, when you receive a certificate from a website, you verify CA's identity with a list of CA stored in the web browser.

My question is, what If I am using a desktop client or terminal to make a request to the webserver? How does verification happen in that case?

Improve this question
2
  • How exactly do you make that request?
    – Tom K.
    Commented Jan 11, 2018 at 18:02
  • Through code like from nodejs or python
    – Taran Vohra
    Commented Jan 11, 2018 at 20:44

1 Answer 1

Reset to default
1

Your client will usually perform the same checks. Get the certificate, and check that it can trace it back to a known root certificate (possibly via one or more intermediate certificates, forming a "certificate chain").

This is the case with curl for instance:

  • you can specify the list of acceptable CA certs using the --cacert option
  • you can disable the check using --insecure (or -k)

The list of acceptable root certificates may vary from one tool to another (it may also depend on the operating system). Some will use a system-wide list, while others will use their own list.

Some tools may not do the verification automatically (or at all), but you'll need to give us details of the specific tool if you want more details.

Improve this answer
2
  • Suppose I make a request to a web API using nodejs (https module), in that case there won't be any verification of the certificate sent by the webserver right?
    – Taran Vohra
    Commented Jan 11, 2018 at 13:54
  • @TaranVohra I believe by default the https client will check the certificate against the list of certificates curated by Mozilla. You can override this using the ca option, though you can easily check for yourself. Set up a server with a self-signed cert and trying connecting to it with default settings...
    – jcaron
    Commented Jan 11, 2018 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .