Re: Buying and selling root certificates

["Robert E. Seastrom" <rs () seastrom com>]

Sean Donelan <sean () donelan com> writes:

> I'm not that interested in SSL for web servers, but I have noticed a
> gradual increase in the number of mail servers willing to STARTTLS with
> mine.  I was experimenting with trying to verify some of the certificates
> presented, its not real security, but makes the logs cleaner.

Most of us who are willing to opportunistically do STARTTLS are using
self-signed certificates anyway.  We do this for many reasons; chief
among the reasons I do so are:

   1) More encrypted traffic running around the Internet is a _good thing_

   2) Even if the contents of my email is PGP-encrypted, headers and
   transactions can still be passively monitored and collected.  This is
   sufficient for drawing relationship graphs.  Opportunistic TLS fixes
   this problem.

Note that "verifying the identity of the guy on the other end and thus
eliminating man-in-the-middle attacks on my email" is not on the list.
STARTTLS-capable MTAs vary in their ability to follow certificate
chains anyway...

                                        ---Rob