9 ms·

How would you run a local HTTPS server without the private key?

• progval 8y ago
  They get one private key per user, and send it to the client's device.
  • ajnin 8y ago
    Which "compromises" the key, according to current Certificate Authorities policies. Once again the problem boils down to CAs being the sole "anchors of trust" in the current certificate system.
    • progval 8y ago
      Then they could have their server tunnel ACME challenges to the device, so the private key never leaves the device, but can still be signed.
  • BillinghamJ 8y ago
    The private key is generated on the client side, and signed by the certificate. Plex has an intermediate which they control to issue these. It would not pass normal validation processes.