4 ms·

Just wondering.. Why use a new CA?

• rdl 15y ago
  The new CA won't invalidate your old CA's cert. You want to preserve availability of the old CA's cert until the new one is deployed across all your servers. In practice, SSL (with CA certified keys issued by lame public CAs) is only really protection from passive eavesdropping anyway; there are enough bad or lax CAs out there that you have to assume an attacker can get a key for an arbitrary site, or can steal a site (not protected in an HSM) from almost any site. There's nothing really wrong with the X509 PKI in the abstract, but it doesn't really work well for real identity on the Internet. Protection from passive attacks is worthwhile, but it's not worth the disruption to your users to push beyond that to try to keep only one key at a time out there.