3 ms·

Fairly sure that they'd be blocked from issuing a new cert with the same key?

• Ajedi32 9y ago
  You'd think so given that Symantec believes the key is compromised, but that's actually not the case. I actually saw a fairly interesting discussion about this over on the mozilla.dev.security.policy mailing list just the other day: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/71AXGTgcX9c https://groups.google.com/forum/#!topic/mozilla.dev.security...
  • hannob 9y ago
    However in that case it was Comodo that didn't block the compromised private key.
    • Ajedi32 9y ago
      Right. If you read the rest of the thread though you'll see that that's because they're not actually required to check. (Or at least, it's certainly arguable that they're not.) Any other CA could have done the same thing and that would be considered perfectly acceptable behavior per the Baseline Requirements.
      • hannob 9y ago
        I started the thread, I have read it :-)
• deleted 9y ago
  [deleted]