• 0 Posts
  • 137 Comments
Joined 1 year ago
cake
Cake day: July 9th, 2023

help-circle

  • xthexder@l.sw0.comtoTechnology@lemmy.worldLet's Encrypt is 10 years old today !
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    edit-2
    4 days ago

    If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively allows MITM for any certificate. Worse, it’s not even limited to certificates under that CA. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).

    Certificate pinning might save things, since that will force the same certificate as was previously used, but I’m not sure this is a common default.