3 ms·
As you said, that only protects against CAs that follow the CA/B Forum Baseline Requirements that require they check CAA at issuance time. If a government was
by prdonahue 9y ago
As you said, that only protects against CAs that follow the CA/B Forum Baseline Requirements that require they check CAA at issuance time.
If a government was coercing a CA, they'd just tell them to disable this check. If this can be proven it's grounds to start the distrust process. At the very least, they should fail their next WebTrust audit.