[saag] Re: wpkops, "WebPKI" and citations

The Web PKI is the trust infrastructure set up an managed by leading
browsers so that server operators can authenticate to browser clients in an
interoperable way.

I think a definition similar to that gets to the heart of what's going on and
should be able to survive future changes and redesigns.

-Tim

> -----Original Message-----
> From: Christian Huitema <[email protected]>
> Sent: Monday, November 17, 2025 4:11 PM
> To: [email protected]
> Subject: [saag] Re: wpkops, "WebPKI" and citations
> 
> 
> On 11/17/2025 12:12 PM, Salz, Rich wrote:
> > 
> > * Might not be quite enough, but if that was in some place I could
> > cite, I'd be
> > * happy.
> >
> >
> >
> > http://www.richsalz.com/ietf/what-is-the-web-pki/
> > <f70d4e31-eb89-4050-8e17-e7a4b2686c36>
> 
> Rich, I don't think that's a good operational definition. If we applied it to "the
> road infrastructure", it would translate to "The collection of entities — roads,
> those running cars, and users who often use public transports — that send and
> retrieve information across the country."
> That does not sound quite right.
> 
> We can certainly isolate pieces of the infrastructure: CAs, browsers that ship with
> embedded lists of trusted CA, crypto stacks that implement verification logic and
> may incorporate default lists of CAs.
> But websites and users, no, not so much, at least not in a general sense. They do
> use the web PKI infrastructure but they are not it.
> Websites, for example, are not exactly at liberty to get site certificates signed by
> arbitrary authority. If they do not chose a CA that is part of "the infrastructure",
> browsers are going to punish them.
> Users may perhaps decide to trust sites outside of the infrastructure, but that's
> like saying that I can decide to not use public transport service and rely on my
> sailboat instead. it does not make my sailboat part of the road infrastructure...
> 
> -- Christian Huitema
> 
> _______________________________________________
> saag mailing list -- [email protected]
> To unsubscribe send an email to [email protected]

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]