4 ms·
> I think it would harm users relying on certain sites. This already happened with CNNIC and .cn Care to elaborate? I don't really understand how it harms user
by netheril96 4y ago
> I think it would harm users relying on certain sites. This already happened with CNNIC and .cn
Care to elaborate? I don't really understand how it harms users.
- ProtoAES256 4y agoCNNIC was caught signing fake Google certs.
- zinekeller 4y agoIn 2015, CNNIC have impersonated Google's domains (which while Google have a minimal presence in China is still a faux pas). Also to clarify: restricting it to specific TLDs where the CA physically operated would amplify local laws, while restricting it to TLDs that are outside the CA's physical presence would basically mess up enforcement and would spur governments to curate a mandatory sanctioned list (heard of EU QWAC?) It's a lose-lose case either way.
- netheril96 4y agoI’m aware of the incident, but I don’t understand your reasoning. Had CNNIC been restricted to issue certificates only for .cn domains, the incident would have never been possible. That should be a supporting evidence for CA name constraints. I don’t understand the “amplifying local law” part. How is restricting the power amplifying?