SSL requires the use of a trusted third party -- the certificate authority to verify a public key presented by a server to a client.

SSH on the other hand relies on the client having the server's public key by some other means (e.g., by accessing it physically from the server and saving it at the client).

Why do these protocols have such a difference in operation mechanisms? I mean they could both use the third party approach which to me seems more user-friendly and possibly more secure.

  • 1
    $\begingroup$ Confirmed cross-post of security.stackexchange.com/questions/126785/… where it already received two answers at the time of writing this. Note that you’re free to edit this question to clarify why a cross-post makes sense in this case. If there’s a good (read: valid) reason for a cross-post, I’ll gladly reopen this. $\endgroup$
    – e-sushi
    Jun 12, 2016 at 5:14


Browse other questions tagged or ask your own question.