2 ms·
And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see be
by notpushkin 4y ago
And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see being yanked.
- dilyevsky 4y agoAren’t they 10y max? I’d assume all the old ones are expired now
- toast0 4y agoI feel like a lot of older CAs all expire around 2038, but those might have been 1024-bit and purged.
- toast0 4y agoI think they've still got to do audits and what not, but following the rules and stuff isn't sufficient to get in the trust stores (and isn't sufficient to stay either; nothing in this case really has anything to do with the guidelines). You also need to have some reason for browsers to care about your certs. Being available and interested in the 90s was good enough, but these days the route is probably pay an existing CA to cross sign your CA (which requires that you follow all the same rules as if you were in the trust stores), wait for usage, and then apply to be in direct.