0

I recently heard from one of my friends that we can create our own SSL certificate.

So IF I am going to create a fake SSL cert for a fake bank site, its going to auto get HTTPS and say secured in browser address bar right?

So how safe are HTTPS sites? (with respect to fake sites)

Improve this question
1

1 Answer 1

Reset to default
3

Your fake certificate need to be signed by a Root Certificate. Root certificates are owned by Certificate Authorities. Certificate authorities are trusted by operating systems and browsers and their certificates are implanted in our devices. If your fake certificate can't be verified by any of these authorities certificates then you cannot have that little green lock in the browser.

Improve this answer
2
  • that solves most of my doubt, then how does do sites like sslforfree.com work?
    – Srinath Ganesh
    Jan 7, 2019 at 9:14
  • 1
    @SrinathGanesh in their website they say "Let's Encrypt is the first free and open CA. We generate certificates using their ACME server by using domain validation". Let's Encrypt is a free Certificate Authority who says: "As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1, is directly trusted by Microsoft products. Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry."
    – daygoor
    Jan 7, 2019 at 9:31

Not the answer you're looking for? Browse other questions tagged .