I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
Are you sure they can’t decrypt? They have your certificate after all.Besides, if the Orange has a bad day, he can ban certificates export or just for a single company or individual.Edit: First two sentences were stupid, I apologize.
The CA cannot decypt: they don’t have the secret key which only the server has. When requesting a new certificate from the CA, the server generated a secret key (aka private key) and then generated a derived public key that goes into a Certificate Signing Request (CSR). The CSR is what the CA receives, not the secret key, and then the CA returns the certificate file to the server, which has been endorsed by the CA and thus trusted by the user base.
Phrased another way, a certificate is the instrument that confirms that a purported public key can in-fact be safely used, and that no MITM attack is happening (assuming you trust the CA that signed the cert). But once you’ve confirmed the public key, the rest of the cryptography is public key cryptography, meaning the secrecy of the secret key is the whole game.
Yes, the private key never leaves your machine.
You send them a certificate signing request with your public key, they put their verification stamp on it and send it to you.
The only part they have to play is verifying that your certificate is trusted by a root certificate.