4 ms·
> Don't you think that it would be better if certificate authorities were limited to certain TLDs? For example, a company from country A limited to A's national
by zinekeller 4y ago
> Don't you think that it would be better if certificate authorities were limited to certain TLDs? For example, a company from country A limited to A's national TLD? This way even if they are ordered to produce a fake certificate, they can only decrypt traffic for country A's sites.
I think it would harm users relying on certain sites. This already happened with CNNIC and .cn, so I don't think that mandatory restrictions would make it better (and besides, the only CAs which voluntarily ask to restrict issuance to certain TLDs are government CAs).
- netheril96 4y ago> I think it would harm users relying on certain sites. This already happened with CNNIC and .cn Care to elaborate? I don't really understand how it harms users.
- ProtoAES256 4y agoCNNIC was caught signing fake Google certs.
- zinekeller 4y agoIn 2015, CNNIC have impersonated Google's domains (which while Google have a minimal presence in China is still a faux pas). Also to clarify: restricting it to specific TLDs where the CA physically operated would amplify local laws, while restricting it to TLDs that are outside the CA's physical presence would basically mess up enforcement and would spur governments to curate a mandatory sanctioned list (heard of EU QWAC?) It's a lose-lose case either way.
- netheril96 4y agoI’m aware of the incident, but I don’t understand your reasoning. Had CNNIC been restricted to issue certificates only for .cn domains, the incident would have never been possible. That should be a supporting evidence for CA name constraints. I don’t understand the “amplifying local law” part. How is restricting the power amplifying?