4 ms·
> A flaw in this system is that any compromised root certificate can in turn subvert the entire identity model. If I steal the Crap Authority's private key and
by sjtgraham 11y ago
> A flaw in this system is that any compromised root certificate can in turn subvert the entire identity model. If I steal the Crap Authority's private key and your browser trusts their certificate, I can forge valid certificates for any website.
You don't have to compromise the root. This could still happen if a trusted intermediate CA's private key is compromised, because that CA's certificate was signed by the CA in the chain of trust that ultimately terminates with a trusted root.
Also, how does rfc7469 work with respect to CRLs and OCSP?