3 ms·
The job of a certificate authority is to verify an identity, not to vet that the holder is using the certificate only for good. As long as the CAs do that job
by tgsovlerkhgsel 6y ago
The job of a certificate authority is to verify an identity, not to vet that the holder is using the certificate only for good.
As long as the CAs do that job (which is a separate issue), it's fine if John Doe can get 50 different CAs to certify that he is, indeed, John Doe.
- ecdavis 6y agoTake a look at the "Baseline Requirements for the Issuance and Management of Code Signing Certificates"[0] - specifically section 13.1. Here's the most relevant excerpt: > A CA MUST revoke a Code Signing Certificate in any of the four circumstances: (1) the Application Software Supplier requests revocation, (2) the subscriber requests revocation, , (3) a third party provides information that leads the CA to believe that the certificate is compromised or is being used for Suspect Code, or (4) the CA otherwise decides that the certificate should be revoked. [0] https://cabforum.org/baseline-requirements-code-signing/ https://cabforum.org/baseline-requirements-code-signing/
- asdfasgasdgasdg 6y agoPlainly whoever is issuing the cert we're discussing sees their role as much broader. Presumably the OS manufacturer also sees it that way.