4 ms·
I’m just curious, what standards did they violate other than circumventing SHA-1 deprecation?
by Tinyyy 10y ago
I’m just curious, what standards did they violate other than circumventing SHA-1 deprecation?
- pfg 10y agoA number of issues can be found here[1]. Among other things, they allowed domain validation on unprivileged ports and issued certificates for "parent" domains when subscribers were able to validate control of a subdomain (i.e. you could get a certificate for github.com by controlling user.github.com). [1]: https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues