Concepts / Encryption and trust

Encryption and trust

Self-signed certificate

Also called certificate pinning, trust on first use, TOFU, fingerprint

A certificate whose issuer is its own subject: nobody vouches for it but itself.

Devices make one for their own web pages, since no public CA signs a name like printer.lab. Trusting it means pinning that exact certificate, and is only safe if the first copy is checked, by its SHA-256 fingerprint, against one read outside the network path. A root CA's certificate is self-signed too; what differs is that trust stores carry it.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Open this lab