3 ms·
How is their universal SSL stuff being handled in China? Is there a separate root they use? Since certs are shared (with lots of SANs) if my site is sharing a c
by MichaelGG 11y ago
How is their universal SSL stuff being handled in China? Is there a separate root they use? Since certs are shared (with lots of SANs) if my site is sharing a cert with one that opts-in to China access, does that mean the private key for that cert is now available to China?
- eastdakota 11y agoWe're using Keyless SSL when HTTPS goes live inside China. That means we can handle HTTPS without any keys being stored inside China.
- skybrian 11y agoIt seems possible that the censors don't need the private keys because they somehow get access to symmetric keys used to terminate the connection. That would be bad, but at least doesn't affect users outside China. (To be clear, this is pure speculation; I have no actual knowledge of such things.)