3 ms·
In the current SSL system there is no such concept as a "private key for a TLD". Every single one of the roots can sign anything. :(
by 0x0 11y ago
In the current SSL system there is no such concept as a "private key for a TLD". Every single one of the roots can sign anything. :(
- deleted 11y ago[deleted]
- cldellow 11y agoSome browsers do restrict CAs, see e.g. http://googleonlinesecurity.blogspot.ca/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.ca/2013/12/further-impr...
- 0x0 11y agoSo a CA got caught red-handed having issued an intermediate CA that spoofed google domains ... and instead of throwing them out of the CA club, their response was to reluctantly limit them to *.fr and 12 other TLDs? Explain why they aren't permanently blacklisted and banned from ever being in the root store for any purpose again???