27 ms·
"DigiNotar should never have been a top-level CA. They should have been a third-party CA underneath Verisign or somebody similar" Look at it from the position
by speleding 15y ago
"DigiNotar should never have been a top-level CA. They should have been a third-party CA underneath Verisign or somebody similar"
Look at it from the position of the Dutch government (or any other government): Who would you trust to digitally sign passports and crucial government communications? (Which is what the Diginotar certificates are being used for). No government would like the idea of being at the mercy of a foreign entity they cannot control.
- icebraining 15y ago>Who would you trust to digitally sign passports and crucial government communications? Myself. I don't understand why governments don't become their own CAs, limited to issuing certificates for official websites and documents. Of course, it would be better if browsers could limit CA trust to certain domains and subdomains (for example, the Portuguese govt CA should only be trusted for .gov.pt domains) to prevent abuse, but on the other hand we all know that if a govt is dirty enough to abuse that they'd be able to pressure some national CA into issuing it.