3 ms·
As a sidenote here: All CA certificates are accepted via emails, and are stored via a salesforce CRM that generates a csv spreadsheet. [1] And yes, this is a
by cookiengineer 5y ago
As a sidenote here:
All CA certificates are accepted via emails, and are stored via a salesforce CRM that generates a csv spreadsheet. [1]
And yes, this is a system running since the 1990s and is very likely running on a heavily outdated UNIX machine.
So from a cyber security point of view, I wouldn't put much faith in the security of the SSL cert chains of the root store itself.
I don't know who maintains them, but I hope these services are not accessible from the internet, though it seems that the database was at least scanned by shodan, so yeah :-/
I really hope that distro maintainers in between validate what they push out as ca-certificates packages everywhere.
[1] https://www.ccadb.org/ https://www.ccadb.org/
- josephcsible 5y agoI don't think that's an authoritative source of trust.
- cookiengineer 5y ago> I don't think that's an authoritative source of trust. The proof is literally in the URL when you click on Resources / CSV download which is the following URL [1] [1] http://ccadb-public.secure.force.com/ccadb/AllCertificateRecordsCSVFormat http://ccadb-public.secure.force.com/ccadb/AllCertificateRec...
- josephcsible 5y agoI know that site has a copy of all the CA certificates. I'm saying it's not the authoritative copy of them. If someone hacked into that and added a rogue CA, your browser wouldn't magically start trusting it.