4 ms·

Does the Dutch government have the expertise necessary to run a CA?

• burgerbrain 15y ago
  Does it particularly matter? All the browsers have de-trusted them already. Not like they could really do any worse. Under previous management they literally allowed the one thing no CA must ever allow to happen.
  • tripzilch 15y ago
    You're conflating the Dutch Government and VASCO/Diginotar.
• Confusion 15y ago
  They already operate a CA: look for 'Staat der Nederlanden' in your browser's root certificate list.
• mpk 15y ago
  My guess is yes, they do. If you read a bit deeper into their announcements you'll notice that this is not just 'the government taking over'. The breach post-mortem was handled by a private sector security company (Fox IT) and the SSL cert management was moved to another private sector firm (Getronics). Judging by the announcements this was overseen by the Ministry of Security and Justice, which has its own well-funded divisions of security specialists. The Dutch government sees digital infrastructure as crucial and invests a lot of time and money into it. Components such as PKI government, etc are initiated by the government but then sourced to the private sector (a fairly common practice). This allows the government to revoke contracts or otherwise intervene if the contractor is in breach of something (bad management, bad governance, failure to comply with security standards, failing audits, etc). I'm guessing that this is also the legal basis for taking over operations from DigiNotar at such short notice. Also, the Dutch government is a world-class player in the eavesdropping, interception, wiretapping and traffic monitoring game. That implies at least a basic in-house competency in network and crypto matters.