4 ms·
I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I t
by chopin 7y ago
I would prefer that root certificates have restriction on what they can sign, eg. a Khazachstan root certificate can't legitimately sign a .com certificate. I think that not having this is a fundamental flaw in the certificate setup.
- thu2111 7y agoX.509 has supported this for a long time and so have browsers, iirc Chrome restricted some French CA to specific domains at one point. The issue here is not so much technical as cultural. Mozilla employees don't know or care about people from Kazakhstan and didn't prioritise finding ways to reduce the disruption.