4 ms·

Also I'd be suprise if they don't have a copy or at least acess to all of the maj root certs and websites. Iean sure maybe Facebook or Apple or AWS takes a stan

by hpoe 6y ago

Also I'd be suprise if they don't have a copy or at least acess to all of the maj root certs and websites. Iean sure maybe Facebook or Apple or AWS takes a stand against the govt. Saying "No you can't have our data" but I doubt Verisign or other root level CAs are so scrupulous.

thr0w3345 6y ago
But that would only allow them to sign new certs, CA’s don’t get the private keys only the public part to sign... Or did I misunderstand you?
- bootloop 6y ago
  That's correct. To sniff traffic without replacing the certificate with one of their own they would need the the private key which was used in a session. (That key might have been derrived from the server private key, but again nothing the CA has access to.)