3 ms·
Anyone have any more information on the incidents that triggered this response? I was able to find this article on Google's Security Blog: https://security.goog
by Ajedi32 10y ago
Anyone have any more information on the incidents that triggered this response? I was able to find this article on Google's Security Blog: https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c...
But that's almost 2 years old. Have there been any more recent incidents that I'm unaware of?
- gcp 10y agohttps://groups.google.com/forum/#!forum/mozilla.dev.security.policy https://groups.google.com/forum/#!forum/mozilla.dev.security...
- agwa 10y agohttps://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05455.html https://www.mail-archive.com/dev-security-policy@lists.mozil...
- pilom 10y agoTL;DR: in 2016 Symantec issued unauthorized certs for example.com (owned by ICANN) and a multi-domain cert with SANs for test1.com, test2.com, test3.com... even though those domains are each owned by very different organizations and did not all agree to have a common cert.
- agwa 10y agoIt's more than that. The ensuing thread uncovered that Symantec had exercised very lacking oversight over their partners (called Registration Authorities, or RAs) who were allowed to perform certificate validation on Symantec's behalf.
- caf 10y ago...and at least one of those RAs didn't seem to be doing any validation at all!