3 ms·

Well, they are directly included in most root programs now (ISRG Root X1). The cross-signing was a bootstrapping and compatibility solution (e.g. Windows XP).

• tialaramex 8y ago
  But still not Microsoft's programme. It would be interesting to know (but we'll probably never be told) if there's any particular reason for it taking so long... https://crt.sh/?caid=7394 https://crt.sh/?caid=7394 The top row of "Valid¹" items with one "No" and one "Defer to OS" is the trust you care about, whether ISRG is trusted for the Web PKI. "Defer to OS" is what Chrome says by default about almost everything - basically Google prefers to let your OS vendor pick what's trusted unless they feel the need to step in and override. I have no idea why Apple trusts ISRG for things ISRG doesn't do and has no intent of starting to do, my instinct is to label it "incompetence" but I've never been an Apple fan, I'm sure they have some excuse. On the other hand, at least Microsoft has a comprehensive and reliable update process, so there's a good chance most of their population of systems can be upgraded in months rather than years once they do make a decision. All but one of the programmes listed is a closed door operation, we have no idea how they decide what to do, and only a cynic like me would suggest that it's because they mostly react to events after the fact... The exception is Mozilla, which makes all these decisions in public in the newsgroup m.d.s.policy