3 ms·
I was under the impression that they can't issue Sub-CAs because the pathlen of their Cert is set to 0. [0] They would have to give their private key to their
by cheshire_cat 10y ago
I was under the impression that they can't issue Sub-CAs because the pathlen of their Cert is set to 0. [0]
They would have to give their private key to their clients to achieve a MITM attack, right?
[0] https://crt.sh/?id=19538258 https://crt.sh/?id=19538258
- msbarnett 10y agoThey might have to deploy their private key on the devices they maintain for their clients, perhaps relying on a secure keystore on-device to try to protect it from client sniffing (presuming quietly selling it to the client isn't part-and-parcel of the deal). Others have suggested they could provide a cloud-type service to achieve the same result.
- cheshire_cat 10y agoThank you, do you have a link with more technical explanations?
- predakanga 10y agoI'm not entirely familiar with sub-CA specifics, but CloudFlare (at the very least) has developed a system for deploying SSL with off-site private keys[0]; I imagine that could be used in a situation like this. [0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...