5 ms·

can i trust this?

• gruez 9y ago
  if you can't trust a CA, then it's already game over, since they can issue certificates for any domain they want without your interaction.
  • michaelmior 9y ago
    Sure, but I assume the question is whether you can trust this particular CA.
    • gruez 9y ago
      presumably they're from a trusted root, so you (and everyone else) already trust them
      • ReverseCold 9y ago
        Certificate resellers can't issue a certificate without you allowing them (by doing domain verification with their root CA). See: that certificate company who emailed a bunch of private keys recently. They were also a digicert reseller.
        • icebraining 9y ago
          They were also a digicert reseller. No, they (Trustico) were a Symantec reseller, and then switched to Comodo. "Although DigiCert took over Symantec's certificate issuance business, it doesn't count Trustico as a reseller." https://arstechnica.com/information-technology/2018/03/23000-https-certificates-axed-after-ceo-e-mails-private-keys/ https://arstechnica.com/information-technology/2018/03/23000...
      • cyphar 9y ago
        TrustICO was also from a trusted root, and look what happened there (same with Comodo and their bad business dealings). Just because DigiCert trust them doesn't mean the company is trustworthy (in the human sense, not the PKI sense).
  • chias 9y ago
    I assume what alexnewman meant was "can I trust that certificates issued by this entity will not be revoked in the near future due to incompetence of the CA", and not "can I trust websites which serve certificates signed by this CA".
• forgotmypw 9y ago
  https://news.ycombinator.com/item?id=16566165 https://news.ycombinator.com/item?id=16566165 I wouldn't.