3 ms·
The thing is that we're not talking downtime here, but rather something in the CA compromised, which would mean that pretty much ANY website could be impersonat
by mvolfik 6y ago
The thing is that we're not talking downtime here, but rather something in the CA compromised, which would mean that pretty much ANY website could be impersonated, as the attacker could issue a Let's Encrypt CA valid certificate for it. That is mitigated by invalidating this CA, but that also invalidates all legit certificates previously issued by them. So they need to reissue them all
- warkdarrior 6y agoLet's Encrypt publishes Certificate Transparency logs: https://letsencrypt.org/docs/ct-logs/ https://letsencrypt.org/docs/ct-logs/ You can both block certs that do not appear in the logs, and decide which certs not to trust ("everything after Friday the 13th at midnight is not trusted"), once you know the date/time of the intrusion.