4 ms·

I'd like to know why Google, Mozilla and Microsoft did no due diligence on this company before approving their root CA. Why does it take being called out by an

I'd like to know why Google, Mozilla and Microsoft did no due diligence on this company before approving their root CA. Why does it take being called out by an independent researcher before these basic questions get asked?

aspyct 4y ago
Maybe they did, and it was fine at the time, and then things became messy?
- masklinn 4y ago
  I expect there’s also been a degree of grandfathering of the root certs from a time where there was a lot less scrutiny.
deleted 4y ago
[deleted]