Changes

A digital certificate is an electronic "ID card" that is issued by a certification authority (CA) and contains information that uniquely identifies the holder, such as their name and address, as well as the digital signature of the CA.  A digital certificate typically contains two types of keys: a public key and a private key. The public key is used to encrypt data and verify digital signatures, while the private key is used to decrypt data and create digital signatures. Together, these keys form a key pair, which is used to secure communications and authenticate the identity of the certificate holder.  For example, when viewing this page, the website presented to the users device a certificate signed by the "Go Daddy Secure Certificate Authority - G2" which one can verify by clicking the lock icon and locating the certificate path information. One can also find a certificate from this CA pre-installed in the trusted root folder on one's device.

A digital certificate is an electronic "ID card" that is issued by a certification authority (CA) and contains information that uniquely identifies the holder, such as their name and address, as well as the digital signature of the CA.  A digital certificate typically contains two types of keys: a public key and a private key. The public key is used to encrypt data and verify digital signatures, while the private key is used to decrypt data and create digital signatures. Together, these keys form a key pair, which is used to secure communications and authenticate the identity of the certificate holder.  For example, when viewing this page, the website presented to the users device a certificate signed by the "Go Daddy Secure Certificate Authority - G2" which one can verify by clicking the lock icon and locating the certificate path information. One can also find a certificate from this CA pre-installed in the trusted root folder on one's device.

== Trusted Root Folder Advantages ==

== Trusted Root CA Folder ==

Advantages to having multiple CAs in the trusted root folder of a PC:

There are several risks associated with having only one CA in the trusted root folder of a PC:

# Flexibility: Having multiple CAs allows a PC to establish secure connections with a variety of different servers and services, which can be useful for connecting to different websites, applications, and networks.

# Single point of failure: Having only one CA in the trusted root folder can create a single point of failure. If that CA is compromised or becomes unavailable, the PC may be unable to establish secure connections with any servers or services that rely on that CA.

# Redundancy and failover: Having multiple CAs in the trusted root folder can provide redundancy in case one of the CAs is compromised or becomes unavailable. This can help to ensure that the PC can continue to establish secure connections even in the event of a failure.

# Lack of flexibility: Having only one CA in the trusted root folder can limit a PC's ability to establish secure connections with a variety of different servers and services. This can be particularly problematic if the CA is not trusted by all organizations or industries.

# Increased security: Having multiple CAs can help to increase the overall security of a PC's trust infrastructure by reducing the potential attack surface and providing increased flexibility in terms of policy and trust management.

# Increased vulnerability to attack: Having only one CA in the trusted root folder can increase the potential attack surface of the PC's trust infrastructure. An attacker may be able to compromise the CA and use it to issue fraudulent certificates, which the PC would then trust.

# Support for legacy systems: Some CAs may be added to the trusted root folder by the user or by an administrator in order to enable specific functionality or to support legacy systems.

# Limited support for legacy systems: Having only one CA in the trusted root folder may limit the ability to support legacy systems or specific functionalities.

# Vendor independence: Different CAs are maintained and updated by different vendors and organizations, so it is possible that some CAs will be replaced or updated over time. Having multiple CAs in the trusted root folder allows a PC to continue to trust new or updated certificates even if one of the CAs is no longer in use.

# Dependence on single vendor: Having only one CA in the trusted root folder means that the PC is dependent on a single vendor for the maintenance and updates of the trusted CA. If that vendor goes out of business or loses its accreditation it can lead to trust issues.

Overall, having multiple CAs in the trusted root folder of a PC can help to ensure that the PC can establish secure connections with a variety of different servers and services, and can help to provide flexibility, reliability, and security in the event that one of the CAs is compromised or becomes unavailable.

Overall, having only one CA in the trusted root folder of a PC can create a single point of failure, limit flexibility, increase the potential attack surface, and limit the support for legacy systems. It also puts the trust of the PC on a single vendor which may not be reliable in the long term.

 

== Examples of CA's being compromised before 2021 ==

== Examples of CA's being compromised before 2021 ==