Okay, but (if the big ones didn’t enforce it) a home made cert would also stop a man in the middle attack.
It would not, because the “man in the middle” would simply provide their own, also self-signed certificate, to the client and the client would have no way of verifying that that certificate is not to be trusted. The client is unable to distinguish between your self-signed cert and the attacker’s. That’s why the CA is needed, to verify that the certificate is actually issued by whoever you think it is.
This is why browsers do not trust self-signed certificates. They can’t verify who that “self” is. Doing away with it is a massive security vulnerability.
It would not, because the “man in the middle” would simply provide their own, also self-signed certificate, to the client and the client would have no way of verifying that that certificate is not to be trusted. The client is unable to distinguish between your self-signed cert and the attacker’s. That’s why the CA is needed, to verify that the certificate is actually issued by whoever you think it is.
This is why browsers do not trust self-signed certificates. They can’t verify who that “self” is. Doing away with it is a massive security vulnerability.
Thanks for the explanation it does make sense.