3 ms·

> If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of busi

> If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of business in a heartbeat. The fact that Trustwave still has their CA certificate proves you wrong. They provided a sub-CA to one of their customers for the purpose of MITM. They got a slap on the wrist, gave a promist that they'd never do it again, and that was it. Your browser still trusts this company that has demonstrated that they are perfectly willing to compromise the safety of the whole CA system for a sale. It wasn't WiFi, but that's not really a relevant detail here. Selling certs for the purpose of MITM is.

pfg 10y ago
This happened in 2012 and caused a number of changes to various root programs[1]. Mozilla, for example, is now forcing CAs to disclose any subCAs they sign. This is also from a time when the Baseline Requirements in its current form were not yet part of e.g. Mozilla's root policy (that only happened later in 2012). It also predates HPKP (and possibly the pinning mechanism Chrome used before that for their own domains, I'm not sure of the timeline). A lot has changed since that incident, and I have no doubt that the reaction to something like this would be different today, especially if a CA does this knowingly. [1]: https://wiki.mozilla.org/CA:Communications#February_17.2C_2012 https://wiki.mozilla.org/CA:Communications#February_17.2C_20...