4 ms·
would simply refusing to recognize NEW symantec certificates issued after a certain date in the near future be a sufficient compromise? it won't affect institut
by kbar13 9y ago
would simply refusing to recognize NEW symantec certificates issued after a certain date in the near future be a sufficient compromise? it won't affect institutions that have pre-existing certificates, which will eventually expire by themselves.
- hdhzy 9y agoIt's not that simple as they can backdate the cert, like StartSSL/WoSign: > It turns out WoSign has repeatedly been lying to Mozilla about backdating SHA-1 SSL Certificates Source: https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-red-handed/ https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-... Certs could be checked via Certificate Transparency but currently this is not required for DV certs.
- majewsky 9y agoBut isn't EV certs where the money is?