4 ms·
Can you point to USG or Chinese CAs that publicly mis-issued or used certs? CNNIC comes to mind and they've been removed. Which others were you thinking about?
by MichaelGG 11y ago
Can you point to USG or Chinese CAs that publicly mis-issued or used certs? CNNIC comes to mind and they've been removed. Which others were you thinking about?
- jMyles 11y agoI'm not aware of any; I was just referring to the evident more general contempt for security.
- andreyf 11y agoCNNIC did not mis-use or mis-issue certs, but issued a cert to an Egyptian company which mis-used it, iirc.
- MichaelGG 11y agoUh, issuing a CA cert to the Egyptian company was the very definition of mis-issuing a cert!
- andreyf 11y agoNo, the definition of mis-issuing a cert is when you issue a Google cert to someone who isn't Google. Not doing due diligence on what people to whom you've issued a cert are doing with it is a little different. This is just semantics, though. I think everyone agrees they done bad.