4 ms·
Fair enough. IdenTrust, DigiCert, and formerly Verisign also had these "ultimately-chained-to-public" roots (The DST root by IdenTrust is not just used by Let's
by zinekeller 5y ago
Fair enough. IdenTrust, DigiCert, and formerly Verisign also had these "ultimately-chained-to-public" roots (The DST root by IdenTrust is not just used by Let's Encrypt^ but also by private companies like (previously) Visa.) Now, I only see cross-signs between established CAs and new CAs (which in all cases that I knew of has already passed Mozilla's (relatively) strict review at the time of cross-sign). I'm pretty sure GMO-GlobalSign no longer offer these products, they now migrated this into an unaudited* private root (kind-of wish to improve this and provide per-organisation roots... but DigiCert is also guilty of this one root for all aproach so I don't know).
* At least externally. I'm pretty sure they still conduct internal audits though.
^ Still in use up to 2024 due to a weird quirk on how Android manages certificate chaining, even though DST Root CA X3 is now expired.