this post was submitted on 09 Aug 2023
48 points (96.2% liked)
Explain Like I'm Five
14263 readers
135 users here now
Simplifying Complexity, One Answer at a Time!
Rules
- Be respectful and inclusive.
- No harassment, hate speech, or trolling.
- Engage in constructive discussions.
- Share relevant content.
- Follow guidelines and moderators' instructions.
- Use appropriate language and tone.
- Report violations.
- Foster a continuous learning environment.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Because of the man in the middle attack.
A self signed certificate could be a fake certificate created to trick you. Let's Encrypt checks the domain name to make sure the certificate is owned by the domain name at least.
For example, if your Dad decides to run a man in the middle attack with the router to check if you are looking at porn, your Dad only has to issue self signed certificates. When you visit a webpage, he can program the local router to send you to his computer before going to the internet.
Kids Computer -> Dad's computer -> Real Website.
Dad's computer will make a self signed cert to interact with your computer, while decrypting the data from the real website. It then reencrypts the data with a self signed cert, that you suddenly decided to accept.
Now your dad / company you are working for knows you are browsing Porn and fires you. This may or may not have been inspired by real life events.
Except it turns out that it was the Bosses / Grandparents who were browsing Porn so nothing happened.
Anyway, Dad's computer on this network setup cannot get a Let's Encrypt certificate. The Sysadmins will go around to everyone's computer or use Windows Group Policy to force the computers of the organization to trust a CA under control of the Sysadmins to get this man in the middle working.