3 ms·
A system that prevent such mis-issuance events from staying secret (Certificate Transparency) is also being worked on and is picking up speed. So what's next?
by ubernostrum 10y ago
A system that prevent such mis-issuance events from staying secret (Certificate Transparency) is also being worked on and is picking up speed.
So what's next? Browsers begin refusing all connections to sites which aren't pinning their keys and using a CA doing transparency? How much of the web do we have to shut off and force into ludicrously-insecure plaintext connections before people start to get that maybe there's room for a spectrum of options here?
- pfg 10y agoI don't think anyone has indicated that there are any plans to enforce key pinning (which is completely separate from Certificate Transparency). Certificate Transparency is required for some CAs (with known mis-issuance events) in Chrome, and I expect it will become mandatory for all publicly-trusted CAs within the next couple of years. I doubt this would affect custom (internal) CAs. I'm not sure I understand the rest of your argument.