3 ms·

I talked to the CA guys at my university once and they don't have access to the keys. They do identity verification and send the documents onwards to some other

I talked to the CA guys at my university once and they don't have access to the keys. They do identity verification and send the documents onwards to some other CA folks at DFN for the actual signing. Makes the whole thing rather pointless imho.

yuhong 10y ago
Of course, this remind me of the ANSSI fiasco in late 2013 where one of the intermediates was used for MITM. From https://bugzilla.mozilla.org/show_bug.cgi?id=693450#c29 https://bugzilla.mozilla.org/show_bug.cgi?id=693450#c29 : "I received email from the CA representative that said that the decision to include this root IGC/A 4096 SHA2 is discontinued (reason is the complexity of the operation and the associated costs)."