What the HTTPS padlock means: how your browser talks in secret on a Wi-Fi anyone can read
Root certificates: the short list of authorities your phone trusts
Anyone can make an HTTPS certificate and sign it with an important-sounding name. Your phone came with a short list of the only signatures it trusts. Someone chose that list long before you bought the phone.
-
1
Two certificates for shop.example reach Miva's phone. A real authority signed one, and "Rono's Trusted Authority" signed the other. The difference was in her phone before she bought it: a list of trusted authorities, about 170 in the Firefox browser, each one a root certificate.
-
2
The shop's certificate was signed by an authority, whose own certificate was signed by a root on the list. The phone climbs this chain of signatures and finds the top on its list.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88