0
$\begingroup$

Currently I am working on a public key certificate. I got a question: Why is a public key certificate needed for TLS/SSL? Wouldn't TLS/SSL itself is enough? What is the role of the certificate?

$\endgroup$
  • $\begingroup$ TLS is built on the premise of certificates for authentication. You can self sign your certificate if using it for yourself and not on a device to be access by the public $\endgroup$ – Richie Frame Oct 28 '14 at 8:33
3
$\begingroup$

The certificate makes sure that whoever you're talking to is who they claim they are. With TLS/SSL without certs you wouldn't notice if you're communicating with an impostor over an encrypted channel instead of whoever you're expecting to communicate with. This leads to so called man-in-the-middle attacks. You really should read this, if you're going to use TLS:

http://en.wikipedia.org/wiki/Certificate_authority

$\endgroup$
0
$\begingroup$

I would only add that use-case is important to know as to whether a Certificate Authority (CA) is needed. If you are using CPanel for your own website and don't want to pay for an SSL cert, you can create a self-signed certificate, and then tell your browser to trust that public key. You are then acting as your own CA, essentially.

Another case might be an app where you can pre-configure the app to a specific public key. E.g. in curl you can set the MD5 checksum of the expected remote host's public key and reject the connection if the public key doesn't match. Such a scenario can eliminate the ability of a Man-in-the-Middle (MitM) attack from being successful unless the private key gets compromised.

For all other use-cases that I'm aware of, you really do need the CA to ensure that an MitM is not sending the user their own public key in place of yours and intercepting all traffic.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.