4 ms·
On 1, I was thinking about the opposite: a potentially-valid CA (probably a smaller one) that has some unclear paperwork, that someone pieces together a narrati
by ethbr0 4y ago
On 1, I was thinking about the opposite: a potentially-valid CA (probably a smaller one) that has some unclear paperwork, that someone pieces together a narrative about, with the intention of getting them booted.
On 2, agreed on the above reproach. But defining that across international and multiple legal jurisdictions, corporate structures, ownership structures, etc. seems... complex. And honestly, not something I'd trust myself with (as a primarily-SWE).
And the external audits don't attest to corporate structure, do they?
- kseifried 4y ago1) If that's the case they should be able to prove they are legitimate without to much effort. If a CA can't prove they are legitimate, well. Err.. they probably need to be booted then. 2) Correct but there are also many CA's that have managed to do a good job here. Why should we allow poorly behaved CAs in when it affects potentially billions of devices and people? As for the external audits correct, they are very narrow in scope, there are also no requirements around change of control (e.g. company A buys an existing root CA).