8 ms·
Having the root CA's private key doesn't give them access to the end entity's private keys. When you ask a CA for a cert, you only provide them with your public
by soitgoes 13y ago
Having the root CA's private key doesn't give them access to the end entity's private keys. When you ask a CA for a cert, you only provide them with your public key (in the form of a CSR) for them to sign. The CSR does not contain the private key.
- mtrimpe 13y agoBut getting an employee to hand over the private key and giving him a gag order afterwards is an option of course.
- meowface 13y agoTrue, but they would have to do this for every single web server they would want to collect information from. Not impossible, but it'd be a lot of work.
- pilsetnieks 13y agohttps://en.wikipedia.org/wiki/Perfect_forward_secrecy https://en.wikipedia.org/wiki/Perfect_forward_secrecy https://en.wikipedia.org/wiki/ECDHE https://en.wikipedia.org/wiki/ECDHE Google is using it, a few other sites, too, though they are in the minority. OpenSSL supports it since version 1.0.0 that was released in March 2010.