← Back to context

Comment by sashank_1509

4 hours ago

I see thanks for the explanation.

The way it’s setup can any CA verify any website, so the weakest link of your CA basically allows an attacker to mimic any website you connect to?

2 comments

sashank_1509

Reply
sethhochberg  4 hours ago

Generally yes - a compromised CA can be used to issue certificates for any domain, which is why when a CA is compromised the first step is usually for browser vendors, OS vendors, etc to immediately remove the compromised CA from their trust lists.

This is the compromise. In exchange for having the ability to easily establish an encrypted connection to pretty much any public web service, the tradeoff is that the entire public internet's encryption is only as good as the operations of the weakest of the big public certificate authorities.