4 ms·
That's because some CAs are revoking certificates for some Russian websites. Of course they'll have technical ability for Major-in-the-Middle attack, so that's
by vbezhenar 5y ago
That's because some CAs are revoking certificates for some Russian websites. Of course they'll have technical ability for Major-in-the-Middle attack, so that's not something I'd exclude.
I wonder if there's rule which disallows CAs to revoke certificates without reason. It seems that those actions undermine the whole web security model.
Kazakhstan was wise to introduce national root certificates.
- ajross 5y agoCite for CA revocations? I hadn't heard that, and a quick google shows just one McClatchy story about a pretty obvious (and English language) propaganda site.
- deleted 5y ago[deleted]
- vbezhenar 5y agoI'm not sure if it was discussed on English websites. I know about revocation of one bank certificate: VTB bank. You can check certificate here: https://crt.sh/?id=5201004735 https://crt.sh/?id=5201004735 Another example is cbr.ru (Central Bank of Russia): https://crt.sh/?id=6051080112 https://crt.sh/?id=6051080112
- captn3m0 5y agoSection 4.9.11 of the CAB Baseline Requirements[0] puts "No Stipulations" on "Other forms of revocation advertisements available" so it's probably something that CAs are allowed to add in their agreements. Otherwise, the list of revocation reasons otherwise (4.9.1.1 Reasons for Revoking a Subscriber Certificate) doesn't seem to cover anything that would apply here. [0]: https://cabforum.org/baseline-requirements-documents/ https://cabforum.org/baseline-requirements-documents/