3 ms·
For those TLDs that had certs, I’m curious: Should those certs have been revoked, since some/all of the associated domains no longer exist?
by CaliforniaKarl 8y ago
For those TLDs that had certs, I’m curious: Should those certs have been revoked, since some/all of the associated domains no longer exist?
- djsumdog 8y agoWhy? I mean the certs are still valid, just for a domain that no longer exists on root DNS servers (You can still publish them to internal DNS). I mean, they'll expire and be non-renewable eventually anyway.
- lucb1e 8y agoUntil someone re-registers the TLD and can now MITM some internal traffic, if it is indeed used internally. I can see the argument for invalidation, even if unlikely. The much more realistic scenario is where you get a cert for 2 years for any ordinary domain, even if your domain expires next month.
- johannes1234321 8y agoHow could they - without private key? - By not revoking and having certificate transparency we rather can see if somebody else tries to take over the domain with a new cert.
- lucb1e 8y agoWith a new cert indeed. One would have to proactively look at transparency logs instead of retroactively, which afaik only the biggest companies on the planet (like Google) do, or maybe not even them.