4 ms·
CT is a joke. Trusting CAs to post all their certs to CT is a non-starter for me. A CA can issue a cert to the NSA and no one would know it.
by AndyMcConachie 4y ago
CT is a joke. Trusting CAs to post all their certs to CT is a non-starter for me. A CA can issue a cert to the NSA and no one would know it.
- tptacek 4y agoThat works until a browser notices the misissued certificate, and then Mozilla removes the CA from their root program.
- wizeman 4y ago... which only works for browsers. What about all the other uses of certificates? TLS itself is used for securing almost every network communication that goes over the Internet nowadays, including SMTP (and even DNS with DNS-over-TLS or DoH, ironically). So how does Mozilla notice that a CA misissued a certificate for my SMTP server or my upstream DNS server? (Answer: it doesn't).
- tptacek 4y agoYour SMTP server can check SCTs the same way a browser can, but we're not talking about SMTP here.