1

I'm confused with the term "Dynamic SSL certificate", how it works and what the difference is with a usual SSL certificate for web communication between client and the server.

For example, I'm using ZAP proxy. We must set the SSL certificates that are dynamically generated by the application and save it, so our browser can use that certificate for proxying the traffic.

Is it possible that SSL certificate doesn't have to be stored on the server and can be dynamically generated by the application? Does Zap also run its own CA (certificate authority? So every generated SSL certificate is clarified on its own?

5
  • Zap uses the term "Dynamic SSL certificate", the action is to generate one. I edited your question to reflect this.
    – schroeder
    Mar 12, 2020 at 11:31
  • You want to look up "self-signed certificates"
    – schroeder
    Mar 12, 2020 at 11:31
  • @schroeder so zap is also act as CA for its own self-signed certificate..? am i correct...? Mar 12, 2020 at 11:35
  • That's one way to look at it. The certificate says "I'm me. Trust me."
    – schroeder
    Mar 12, 2020 at 11:46
  • "To prevent this from happening, ZAP generates an SSL certificate for each host, signed by its own Certificate Authority (CA) certificate. This CA certificate is generated the first time ZAP is run, and is stored locally." Mar 12, 2020 at 15:03

1 Answer 1

1

I think all this means is that:

  • Zap requires an SSL cert to intercept your browser connections
  • To do this, they'll need to create a CA cert that users need to install on their browsers
  • Instead of creating one static CA cert used by all their users, they create a dynamic CA cert that users generate individually and install on their machines during setup.
  • This way, if someone compromises a users CA, that compromise doesn't impact other users using their solution -- as every user has a unique CA cert.

The 'dynamic' only refers to the CA cert, and it being unique per user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .