<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><blockquote type="cite"><span style="font-family: Monaco; font-size: 12px;">Is it a loss of security if I publish the CA certificate by - let's say - a web site so visitors of my https-protected web site can import it to their browser's cert list?</span><br></blockquote><blockquote type="cite"><span style="font-family: Monaco; font-size: 12px;">As I understood no one else can use my CA certificate to sign own certificates without knowing the key. Is this right?</span></blockquote><br><div>You are right that no one else can use that certificate for signing own certificates. But still I would consider that a very bad security practice.</div><div>If you ask your visitors to install your CA certificate, you ask them to trust you and your security-practices. With that you could (more or less easily) intercept their HTTPS-traffic. And if you don't handle your security right (you should always assume that you also do mistakes) then others can intercept their traffic. </div><div><br></div><div>Why should you ask them to trust you in that way especially when there are other ways available that work without that?</div><div><br></div><div>regards, Karsten</div><div><br></div></body></html>