3 ms·
At least certificate transparency means it’s possible to check if malicious certificates where issued.
by tinus_hn 4y ago
At least certificate transparency means it’s possible to check if malicious certificates where issued.
- jrockway 4y agoI think that interpreting the results can be confusing. Companies can certainly check their own domains regularly, but as an ordinary web user, it's difficult to determine from CT logs whether or not example.com that you are about to visit has a fraudulently issued cert or not. Maybe they happened to legitimately switch providers that day. You weren't in the meeting, you don't know. (I know that CAA records exist in DNS, which are a good signal. But there isn't DNS change transparency; every DNS reply can be unique, so someone can easily serve a faulty CAA record to an evil/hacked CA, and you wouldn't notice. DNSSEC exists to solve this particular problem, but is its own new and exciting set of problems that I have yet to fully understand.)