4 ms·

A bit offtopic but how does one actually become a CA? Anyone has any good write ups on the costs and timeline involved?

woodruffw 4y ago
Anybody can become a CA; there’s no real cost. If you mean becoming a CA that browsers list in their trust roots: you need to obey the CA/B baseline requirements[1], which are reasonably onerous given the position of extraordinary trust it affords you. There are other requirements for other kinds of CAs as well (for example, codesigning in Windows). [1]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.6.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
- notpushkin 4y ago
  And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see being yanked.
  - dilyevsky 4y ago
    Aren’t they 10y max? I’d assume all the old ones are expired now
    - toast0 4y ago
      I feel like a lot of older CAs all expire around 2038, but those might have been 1024-bit and purged.
  - toast0 4y ago
    I think they've still got to do audits and what not, but following the rules and stuff isn't sufficient to get in the trust stores (and isn't sufficient to stay either; nothing in this case really has anything to do with the guidelines). You also need to have some reason for browsers to care about your certs. Being available and interested in the 90s was good enough, but these days the route is probably pay an existing CA to cross sign your CA (which requires that you follow all the same rules as if you were in the trust stores), wait for usage, and then apply to be in direct.
bjt2n3904 4y ago
With EasyRSA, you can become your own CA for your own personal devices! (Though on Android, installing a custom CA does give you a perpetual warning notice.) In combination with my PiHole setup at home, all my devices have names and SSL certificates, protecting them from being snooped on by things like my Chromecast!
- dilyevsky 4y ago
  Obviously not looking for a guide how to use openssl cli, I mean CA added into trust stores (or cross-signed)
chasil 4y ago
Corporations also run internal CAs that cannot issue certificates outside their own domains.
- mr_toad 4y ago
  They often issue certificates outside their own domains, for example they use them on middleware applications. It’s very common in large organisations.
LVB 4y ago
The "Security. Cryptography. Whatever" podcast had an episode on exactly that: https://securitycryptographywhatever.buzzsprout.com/1822302/9146390-how-to-be-a-certificate-authority-with-ryan-sleevi https://securitycryptographywhatever.buzzsprout.com/1822302/...

Anybody can become a CA; there’s no real cost. If you mean becoming a CA that browsers list in their trust roots: you need to obey the CA/B baseline requirements[1], which are reasonably onerous given the position of extraordinary trust it affords you. There are other requirements for other kinds of CAs as well (for example, codesigning in Windows). [1]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.6.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

notpushkin 4y ago
And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see being yanked.
- dilyevsky 4y ago
  Aren’t they 10y max? I’d assume all the old ones are expired now
  - toast0 4y ago
    I feel like a lot of older CAs all expire around 2038, but those might have been 1024-bit and purged.
- toast0 4y ago
  I think they've still got to do audits and what not, but following the rules and stuff isn't sufficient to get in the trust stores (and isn't sufficient to stay either; nothing in this case really has anything to do with the guidelines). You also need to have some reason for browsers to care about your certs. Being available and interested in the 90s was good enough, but these days the route is probably pay an existing CA to cross sign your CA (which requires that you follow all the same rules as if you were in the trust stores), wait for usage, and then apply to be in direct.

bjt2n3904 4y ago

With EasyRSA, you can become your own CA for your own personal devices! (Though on Android, installing a custom CA does give you a perpetual warning notice.) In combination with my PiHole setup at home, all my devices have names and SSL certificates, protecting them from being snooped on by things like my Chromecast!

dilyevsky 4y ago
Obviously not looking for a guide how to use openssl cli, I mean CA added into trust stores (or cross-signed)

chasil 4y ago

Corporations also run internal CAs that cannot issue certificates outside their own domains.

mr_toad 4y ago
They often issue certificates outside their own domains, for example they use them on middleware applications. It’s very common in large organisations.

LVB 4y ago

The "Security. Cryptography. Whatever" podcast had an episode on exactly that: https://securitycryptographywhatever.buzzsprout.com/1822302/9146390-how-to-be-a-certificate-authority-with-ryan-sleevi https://securitycryptographywhatever.buzzsprout.com/1822302/...