3 ms·
Ok, but that's not really a security problem. You don't give out your private key when getting a certificate.
by Buge 10y ago
Ok, but that's not really a security problem. You don't give out your private key when getting a certificate.
- inimino 10y agoActually many customers let the CA generate the private key and copy it onto their servers, but that's not the point. It's a trust problem because of the pattern of this particular CA. Whether you call that a security problem or not is semantics. If not for the existing pattern of behavior, people would be a little more willing to look charitably on this as an honest mistake or trying to help, but given the history the assumption of good faith has been considerably weakened.