▲ | alphazard 5 days ago | |
A certificate is just a fancy way of saying one key pair signed a message containing another public key. It is a link in a cryptographic chain of trust. Given that you already trust a public key, you should also trust some other public key with certain caveats because the first public key signed a message containing the second key and whatever else. A list of allowed domain names is a possible caveat. An onion address is more like an IP address, except it is stable for hosts across time, and it contains enough information to cryptographically prove identity. It may be true that the browser interprets it as a domain name, but it is really operating at the network level where Tor is the network. A certificate for a Tor address means you can go from DNS to a Tor address because the certificate will contain a list of allowed domains and the tor address contains a public key, same as usual. |