[otabdeveloper4]

Doesn't matter. PKI for https is a solution in search of a problem. In reality all it does is just validate domain name ownership, something that could have more easily been done with DKIM keys. We don't need certificate authorities.

[IrishTechie]

That’s an interesting take that would probably make for a fascinating separate HN thread to discuss

[jakupovic]

Probably not much to say other than all of our current takes are based on a half-finished system originally designed for telephone and X.500 (DAP+LDAP && GoBlue) standards. Pretty new to me, after 25+ years ;), and the x509v3 things I kept using in openssl finally made some sense, see

https://en.m.wikipedia.org/wiki/X.500 and especially the "The relationship of the X.500 Directory and X.509v3 digital certificates" which say that web servers/commerce was crafted on a system which didn't support remote directories and needed something local, hence the CAs and CA stores. Copied here for reference:

"The current use of X.509v3 certificates outside the Directory structure loaded directly into web browsers was necessary for e-commerce to develop by allowing for secure web based (SSL/TLS) communications which did not require the X.500 directory as a source of digital certificates as originally conceived in X.500 (1988). One should contrast the role of X.500 and X.509 to understand their relationship in that X.509 was designed to be the secure access method for updating X.500 before the WWW, but when web browsers became popular there needed to be a simple method of encrypting connections on the transport layer to web sites. Hence the trusted root certificates for supported certificate authorities were pre loaded into certificate storage areas on the personal computer or device."