The Chain of Trust: Signing TLS

Sat, 25 Apr 2026 18:23:33 +0530

The Trust Problem Link to heading

If you haven’t been following along, this is part of the series Encryption in Transit.

So far, everything sounds nice in theory. You and a server has a public key, you use it to create a pre-computed symmetric key and talk securely, done.

But, how do you even know that public key belongs to the server you think it does? Link to heading

Like, imagine you’re trying to connect to your bank. You ask for its public key, and you get a response containing the public key. Cool. But how do you know it’s really the bank you’re talking to? What if there is an actual attacker sitting and intercepting every request you make to your bank? Which means if you go to bank.com it is actually an attacker trying to portray itself as bank.com and never letting your request reach to the ACTUAL bank.com. In this case, they can just hand you their public key, you happily encrypt everything with it, and now they’re reading all your traffic while pretending to be the bank.

Domain Verification on DevLogs

The Chain of Trust: Signing TLS

The Trust Problem Link to heading

But, how do you even know that public key belongs to the server you think it does? Link to heading