Buying and selling root certificates
Robert E. Seastrom
rs at seastrom.com
Thu Apr 29 00:19:00 UTC 2004
Sean Donelan <sean at donelan.com> writes:
> I'm not that interested in SSL for web servers, but I have noticed a
> gradual increase in the number of mail servers willing to STARTTLS with
> mine. I was experimenting with trying to verify some of the certificates
> presented, its not real security, but makes the logs cleaner.
Most of us who are willing to opportunistically do STARTTLS are using
self-signed certificates anyway. We do this for many reasons; chief
among the reasons I do so are:
1) More encrypted traffic running around the Internet is a _good thing_
2) Even if the contents of my email is PGP-encrypted, headers and
transactions can still be passively monitored and collected. This is
sufficient for drawing relationship graphs. Opportunistic TLS fixes
this problem.
Note that "verifying the identity of the guy on the other end and thus
eliminating man-in-the-middle attacks on my email" is not on the list.
STARTTLS-capable MTAs vary in their ability to follow certificate
chains anyway...
---Rob
More information about the NANOG
mailing list