4 ms·
This wasn't even a single site - it was an entire TLD that got revoked. There's no excuse for that kind of action unless the private key for that TLD was compr
by djrogers 11y ago
This wasn't even a single site - it was an entire TLD that got revoked. There's no excuse for that kind of action unless the private key for that TLD was compromised.
Breach notification in 3..2..1...
- 0x0 11y agoIn the current SSL system there is no such concept as a "private key for a TLD". Every single one of the roots can sign anything. :(
- deleted 11y ago[deleted]
- cldellow 11y agoSome browsers do restrict CAs, see e.g. http://googleonlinesecurity.blogspot.ca/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.ca/2013/12/further-impr...
- 0x0 11y agoSo a CA got caught red-handed having issued an intermediate CA that spoofed google domains ... and instead of throwing them out of the CA club, their response was to reluctantly limit them to *.fr and 12 other TLDs? Explain why they aren't permanently blacklisted and banned from ever being in the root store for any purpose again???
- kpcyrd 11y agoCertification is tld agnostic. The only plausible reason to revoke certs by tld would be an error in the dns root for .pw, which would be bad for a company that verifies domain ownership as a business.