Hacker News new | ask | show | jobs
by Natanael_L 3876 days ago
That's just the TOFU/POP trust model, same as unverified SSH server keys. Doesn't help against persistent MITM.
1 comments

Sure it does. The information in the certificate is signed (by the intermediate CA) and will contain a certificate chain that leads to a trusted CA and the email address and possibly even the subject's name will be encoded within the certificate. If you can trust the root CA, you can trust that the other party is who they say they are.

Then we get to argue whether NSA can get bogus valid certificates from the commercial CA's... Of course you could roll your own CA but then both parties need to trust it.