CODEWITHSUNDEEP
securitycertificatessl-certificatex509certificateca
Michael Brenndoerfer
Michael Brenndoerfer

Reputation: 4066

How to correctly distribute root-CA's?

Lets say I have a signing-CA

I want to distribute the signing-CA PEM to my clients

What is best practice for distributing the PEM?

Seems to be that providing a public or at least restricted download link is totally sufficient. Is that correct or am I missing something?

Upvotes: 2

Views: 1410

Answers (1)

bartonjs
bartonjs

Reputation: 33098

There's no secret to a certificate, they're routinely published to unauthenticated HTTP (not S, though you can do both) as part of Authority Information Access chaining.

If you're a self-signed/root CA there's a trust bootstrapping problem, where your users have to take it on faith that you are you (and that they don't get the wrong cert from the Man in the Middle). An HTTPS endpoint helps with that; as does embedding the certificate in an Authenticode-or-otherwise-signed client tool.

Upvotes: 4

Related Questions