3 ms·
This "Android intentionally does not enforce the expiration dates of certificates used as trust anchors" - seems like another issue. And now LE is basically bu
by edoceo 6y ago
This "Android intentionally does not enforce the expiration dates of certificates used as trust anchors" - seems like another issue. And now LE is basically building features on an implementation flaw?
- schoen 6y agoI agree with you conceptually, but it seems like everyone wants this and nobody doesn't want it, so as the lawyers sometimes say, "no harm, no foul". In particular, the users of the Android devices want to continue to be able to access sites protected with Let's Encrypt, the site operators want to continue to allow this, Let's Encrypt wants to continue to allow this, and the auditors and root program operators decided that they don't consider it improper either. You're right to describe it as an implementation flaw -- among other things, it removes the lever that root programs normally have to ensure continued compliance by CAs.
- stjohnswarts 6y agoThanks for the explanation. Sometime pragmatism has to overcome idealism/semantics to keep things moving.