0

This question already has an answer here:

I recently heard from one of my friends that we can create our own SSL certificate.

So IF I am going to create a fake SSL cert for a fake bank site, its going to auto get HTTPS and say secured in browser address bar right?

So how safe are HTTPS sites? (with respect to fake sites)

marked as duplicate by Steffen Ullrich, Community Jan 7 at 9:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

Your fake certificate need to be signed by a Root Certificate. Root certificates are owned by Certificate Authorities. Certificate authorities are trusted by operating systems and browsers and their certificates are implanted in our devices. If your fake certificate can't be verified by any of these authorities certificates then you cannot have that little green lock in the browser.

  • that solves most of my doubt, then how does do sites like sslforfree.com work? – Srinath Ganesh Jan 7 at 9:14
  • 1
    @SrinathGanesh in their website they say "Let's Encrypt is the first free and open CA. We generate certificates using their ACME server by using domain validation". Let's Encrypt is a free Certificate Authority who says: "As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products. Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry." – daygoor Jan 7 at 9:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.