4 ms·

Sounds like a good test case for exercising those otherwise useless "million dollar insurances" that some certificate vendors flash in their sales materials?

• donmcronald 6y ago
  Have you ever read the terms? I don't know if they even publish them anymore, but I read one many years ago. TLDR; 1. The CA must misissue a cert. 2. The misissued cert is used by a malicious party to impersonate you. 3. Every user (your users) must prove their damages and claim individually. 4. There might have been a low maximum, per-user claim, but I can't remember. I'd be amazed if there's a single person on the internet who's been paid out by that warranty.
  • tialaramex 6y ago
    Yes, it's useless insurance. The interesting thing is that useless insurance is illegal to sell in lots of places† - to consumers, but here the insurance was sold to the root CAs which are huge corporations so they don't care that it's useless because they only bought it as a PR exercise. †This is the root of a huge scandal in the UK that resulted in banks refunding people years of fees for a product called PPI which they should never have been sold. As a secondary effect this resulted in annoying spam from firms who'd help you claim your money back. By the end I almost felt sad I hadn't fallen for the original scam, because I was being inconvenienced by all the spam but (since I hadn't lost anything) not getting a pile of cash as a refund.