{"action":"closed","issue":{"url":"https://api.github.com/repos/mattcaswell/ossl-book/issues/1","labels_url":"https://api.github.com/repos/mattcaswell/ossl-book/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/mattcaswell/ossl-book/issues/1/comments","events_url":"https://api.github.com/repos/mattcaswell/ossl-book/issues/1/events","html_url":"https://github.com/mattcaswell/ossl-book/issues/1","id":113838367,"number":1,"title":"CAs","user":{"login":"SteveMarquess","id":15360600,"avatar_url":"https://avatars.githubusercontent.com/u/15360600?v=3","gravatar_id":"","url":"https://api.github.com/users/SteveMarquess","html_url":"https://github.com/SteveMarquess","followers_url":"https://api.github.com/users/SteveMarquess/followers","following_url":"https://api.github.com/users/SteveMarquess/following{/other_user}","gists_url":"https://api.github.com/users/SteveMarquess/gists{/gist_id}","starred_url":"https://api.github.com/users/SteveMarquess/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SteveMarquess/subscriptions","organizations_url":"https://api.github.com/users/SteveMarquess/orgs","repos_url":"https://api.github.com/users/SteveMarquess/repos","events_url":"https://api.github.com/users/SteveMarquess/events{/privacy}","received_events_url":"https://api.github.com/users/SteveMarquess/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-28T14:49:05Z","updated_at":"2015-10-28T16:41:29Z","closed_at":"2015-10-28T16:41:29Z","body":"Section 2.1 introduces the concept of a root certificate in a simplistic way:\r\n\r\n\"Having obtained a private/public key pair a server operator will apply to a\r\nthird party organisation, known as a Certificate Authority (CA) for a certifi-\r\ncate.\"\r\n\r\nThat is indeed the common perception, that the root certificates owned by proprietary companies and bundled with popular browsers, and server certificates signed by them, are somehow special. That isn't entirely true, and in some circumstances an organization would be wise to sign their server certs with a root cert that they own and control exclusively.\r\n\r\nAt this introductory stage of the book that's too much complexity to get into (the whole x.509 \"spaghetti of doubt\" thing). But, I think this first mention of root certs should just note, for now, that a certificate is created from the private/public key pair. The footnote can state that this can be done with a rook certificate by the server operator or (most commonly) via a commercial CA. That way we don't reinforce a common misperception."}}