4 ms·
CAs should never intercede without a court order. That's how societies determine what is illegal: we let judges and courts sort it out. Otherwise you're making
by MichaelGG 11y ago
CAs should never intercede without a court order. That's how societies determine what is illegal: we let judges and courts sort it out. Otherwise you're making CAs ad-hoc courts which is a bad thing to do. It provides excuses to refuse to issue certificates based on how they feel.
If a site is "blatantly criminal" then it should be an easy thing to get a court to agree and issue an action against them.
I'm surprised that CA guidelines even allow CAs to take website content into issuing procedures.
- ikeboy 11y ago>CAs should never intercede without a court order. Are you proposing a law to ban this? Would this apply to any company deciding not to do business with a customer for legal reasons? >It provides excuses to refuse to issue certificates based on how they feel. A CA is perfectly within its rights to do that, though! As far as I know, no law obligates CAs to serve everyone.
- MichaelGG 11y agoNothing to do with law. CAs are bound by the requirements that Mozilla, MS, Google and others set out. These requirements obviously go far beyond the law. For instance they require that a CA issue certs to the public (IIRC), so you can't become a trusted CA if you're only issuing for your company. I'm not sure why you are trying to turn this into legal issue for companies. Of course they can do whatever they want. But then Mozilla and others should respond by revoking trust. Specifically, no trusted CA should be revoking or refusing certs on non-identity issues. That seems like a perfectly reasonable requirement to hold CAs to as part of including them in default trust stores.