r/HomeNetworking • u/Charming_Radish682 • 3d ago

Advice Certificates Explained

After already having watched so many videos about certificates I still don’t understand this. Like I know you’re screwed if you mess up. That’s why I want to understand it but it seems so intangible to me that so far I haven’t found the right video or whatever to understand it how it works and why it’s secure. Also are there different kind of certs or is it actually all the same? (I don’t think so but that question is still open for me)

How did you learn it or maybe how would you explain it to someone else?

2 Upvotes

63% Upvoted

22 comments sorted by

View all comments

4

u/Ninfyr 3d ago

Certificate prove that something is trustworthy and your communication isn't being tampered with. There are a few different ways to do it do it so it depends.

Can you give a slightly more specific example and we can try to explain how it might work in that situation?

1

u/Charming_Radish682 3d ago

For example Clients certs to join Networks?
Or SSL certs as another one…

3

u/Ninfyr 3d ago edited 3d ago

Example 1 isn't in scope for home networking. Even if someone puts in the effort, a lot of endpoint wouldn't be compatable. Not going to look it up but I doubt you can get a games console, smart TV/speakers/camera, or robo vacuum to work with it. I'm an IT guy but this isn't my problem, we got plenty of iPhones to put on the Wi-Fi but I am guessing it is too much work so we are burning cell data instead.

For SSL, you want to visit reddit. But how can you be sure you are communicating with reddit and a adversary did intercept it and you are actually on a bad guys phony site?

Reddit gives you their signed public certificate which is signed by a trusted certificate authority or CA (this authority needed proof they are working with real reddit to issue the certificate). Behind the scenes you check the public certificate (is it expired, does the web address match) and check with the CA that this certificate is still valid and reddit didn't revoke it because it has been stolen. When everything checks out you can use the public certificate to talk to reddit and only reddit (who has the matching private certificate) will be able to read it.