4 ms·
Not sure how one would achieve this. It certainly would require new infrastructure. As far as the browser is concerned, the certificate is issued by a root CA t
by dastx 7y ago
Not sure how one would achieve this. It certainly would require new infrastructure. As far as the browser is concerned, the certificate is issued by a root CA that the computer (or browser) trusts. You'd need a tool or a header or something that tells the browser what the original cert is. The browser could then check if this matches the actual cert and then warn.
- zamadatix 7y agoIt's not like there is an overflowing number of publicly trusted CAs. Just encode the list in the signed browser code. Of it's not in the list but it's in the machines trusted root store still trust it but note it's an uncommon CA to the user.
- dogma1138 7y agoIt doesn’t require new infrastructure most modern browsers support HTTP Public Key Pinning. Since the browser vendor can pin their own keys in the distribution it gives you a sufficiently resilient proof against impersonation as all other keys can be validated through a connection that is known to be non susceptible to impersonation.