1

I'm confused with the term "Dynamic SSL certificate", how it works and what the difference is with a usual SSL certificate for web communication between client and the server.

For example, I'm using ZAP proxy. We must set the SSL certificates that are dynamically generated by the application and save it, so our browser can use that certificate for proxying the traffic.

Is it possible that SSL certificate doesn't have to be stored on the server and can be dynamically generated by the application? Does Zap also run its own CA (certificate authority? So every generated SSL certificate is clarified on its own?

Improve this question
5
  • Zap uses the term "Dynamic SSL certificate", the action is to generate one. I edited your question to reflect this. – schroeder♦ Mar 12 '20 at 11:31
  • You want to look up "self-signed certificates" – schroeder♦ Mar 12 '20 at 11:31
  • @schroeder so zap is also act as CA for its own self-signed certificate..? am i correct...? – Wira Bhakti Mar 12 '20 at 11:35
  • That's one way to look at it. The certificate says "I'm me. Trust me." – schroeder♦ Mar 12 '20 at 11:46
  • "To prevent this from happening, ZAP generates an SSL certificate for each host, signed by its own Certificate Authority (CA) certificate. This CA certificate is generated the first time ZAP is run, and is stored locally." – Patrick Mevzek Mar 12 '20 at 15:03
1

I think all this means is that:

  • Zap requires an SSL cert to intercept your browser connections
  • To do this, they'll need to create a CA cert that users need to install on their browsers
  • Instead of creating one static CA cert used by all their users, they create a dynamic CA cert that users generate individually and install on their machines during setup.
  • This way, if someone compromises a users CA, that compromise doesn't impact other users using their solution -- as every user has a unique CA cert.

The 'dynamic' only refers to the CA cert, and it being unique per user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.