this post was submitted on 16 Dec 2024
354 points (97.8% liked)
Technology
59963 readers
3330 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I see where you're getting at, or so I think:
A malevolent user takes over my website and installs his non-authorised certificate => danger!
But I mean he can use my certificate, it's already there, installed and set up to work?
If he fully takes over your website there's nothing you can do as a client to detect it. But that's not the point of the certificate. The certificate is there to ensure you are communicating with the website/server you think you're communicating with.
It ensures your communication is safe. In my example, the attacker doesn't take over your website, he takes over some part of the network infrastructure between your website and the client, thus intercepting all the traffic. There's a "man in the middle", e.g. the website is safe, the client is safe, but the communication between them is not. The certificate ensures nobody is impersonating the website by intercepting all the traffic, ensuring the communication.
If the website does get compromised, the CA has the option to invalidate the certificate at your request, via some verification procedure. Thus it also defends against compromised servers, though it's not the primary purpose for which they exist.