2
$\begingroup$

I've been working on the topic of certificates for a little while, and here is what I understand:

  • A certificate is basically a public key + some data about the owner of the certificate + a signature made by the private key of the owner
  • When a client wants to communicate with a server, the server sends him its certificate, and so the client is able to ensure that he is communicating with the server
  • A server's certificate is supposed to be signed by a certification authority trusted by the client. That means that the server is trusted by someone the client trusts. If we assume that the trust is transitive, that implies the client trusts the server.

I'm OK with that if the CA has investigated the server, and then it is legitimate to tell that the server it is trustworthy.

But I saw that some CAs give certificates automatically (e.g. Let's Encrypt). Then I am wonder how the CA can ensure the server is trustworthy...

Is there something I missed ?

| improve this question | |
$\endgroup$
  • $\begingroup$ "Duplicate" of security.stackexchange.com/questions/87443/… (but on a different SE site, so can't mark it as such) $\endgroup$ – bartonjs Jul 22 '19 at 15:30
  • 3
    $\begingroup$ "made by the private key of the owner" is incorrect. The signature in a certificate is made using the private key of the certification authority that issued the certificate, which is the private key of the owner only for so-called self-signed certificates. The certificate typically also contains identification of the certification authority's public key. $\endgroup$ – fgrieu♦ Jul 22 '19 at 17:16
  • $\begingroup$ I agree with bartonjs, this is identical to the question asked on security.SE. And as this is about security more than cryptography, I'll close the question as off topic. Of course, if you have a crypto specific question about certificates, please feel welcome to ask here - a question on hold is not punishment or anything like that. $\endgroup$ – Maarten Bodewes♦ Jul 22 '19 at 18:22
  • $\begingroup$ I'm voting to close this question as off-topic because this is more about security than cryptography, and it already has an answer on security.SE. $\endgroup$ – Maarten Bodewes♦ Jul 22 '19 at 18:22