Using certificates for SSH authentication
Using certificates for SSH authentication
Posted Nov 10, 2022 9:26 UTC (Thu) by tialaramex (subscriber, #21167)In reply to: Using certificates for SSH authentication by matthias
Parent article: Using certificates for SSH authentication
> And no, the browsers default of trusting every CA on the planet to sign any website on the planet is not really a secure way.
Theory: The browsers just trust every CA on the planet with no oversight, my team will run our private CA very well.
Practice: m.d.s.policy does provide meaningful oversight and most browsers either tacitly or not do roughly what m.d.s.policy decided
Meanwhile, who is running your private CA? Huh, I thought it was Bob but he left in May. Maybe Sarah has Bob's old laptop? Oh, the CA is just a Perl script on old-web-test-04.example.com. No chance bad guys will find it on there right?
In principle running a CA ought to be fine, in practice it's exactly the sort of thing people are bad at, and so it will usually be done badly.