SSL - CN Validation with self signed certificates

问题:

I need expert advise on CN validation with the self signed certificates. Here is the scenario.

• Server is installed with the self signed certificate
• Client (not browser) installed with same self sighed certificate for the purpose of trust validation of server during server authentication. Client has no access to any other certificates for trust validation.

In this scenario, what are the implications of NOT doing CN validation? What are the possible security concerns? [Assume - Private key on the server is safe]

回答1:

If you have a pre-shared public key, you do not need a CA to validate the key; you can just directly compare it. It's actually trivial to do. This isn't used because it doesn't scale at all, and it means that if the private key does get stolen then there's nothing you can do about it (other than going to every client and changing what keys it trusts, which brings us straight back to “doesn't scale”).