4 ms·

It looks like Fastly started working on Certainly sometime before March 2019, because that’s when they filed a trademark application. [1] Three years seems lik

It looks like Fastly started working on Certainly sometime before March 2019, because that’s when they filed a trademark application. [1] Three years seems like a long time to be working on a CA! [1] https://uspto.report/TM/88345271 https://uspto.report/TM/88345271

tialaramex 4y ago
That sounds about right to be honest. The part of the process which is essential to be useful is to obtain trust from the Browser vendors/ OS vendors in their role representing the Relying Parties (ie in this case, ordinary users like you or me). And in practice although you need all of the big ones to be OK with it, the one that matters is Mozilla, via m.d.s.policy, a public group overseeing this well, policy for Mozilla both directly as the vendor of Firefox, and as de facto trust store for Free Unix systems. Now, m.d.s.policy wants to see a whole bunch of paperwork, including audits, beginning from when you began setting stuff up, your own policy documents etc. and it sometimes wants these fixed so you need to go around the loop again. During this you need a complete, working, system, with the only differences from your final public system being maybe scale and the fact you aren't actually directly trusted. But in practice you will have trust via a cross signature (in this case GoDaddy) so you are trusted, just indirectly - if you screw up that's for real and that's going to be a big deal. Example: m.d.s.policy wants to see what a working secured web site will be like, so you spin up a site which exists only to show that yup, we can issue a correct leaf cert for the site, with a valid expiry date, path leading back to GoDaddy, if testers tell their test system that it trusts $newCA, then it says it's valid from you not GoDaddy, check. Another example: m.d.s.policy wants to see that expiry works properly, so you spin up a site with a two month old certificate but only a month of validity. Except wait, if you're like Let's Encrypt/ ISRG you intentionally don't have manual issuance so you literally need to use your normal automated issuance process and then wait until the certificate expires to show that this works. Let's Encrypt really did this. Twice I think.

tialaramex 4y ago

That sounds about right to be honest. The part of the process which is essential to be useful is to obtain trust from the Browser vendors/ OS vendors in their role representing the Relying Parties (ie in this case, ordinary users like you or me). And in practice although you need all of the big ones to be OK with it, the one that matters is Mozilla, via m.d.s.policy, a public group overseeing this well, policy for Mozilla both directly as the vendor of Firefox, and as de facto trust store for Free Unix systems. Now, m.d.s.policy wants to see a whole bunch of paperwork, including audits, beginning from when you began setting stuff up, your own policy documents etc. and it sometimes wants these fixed so you need to go around the loop again. During this you need a complete, working, system, with the only differences from your final public system being maybe scale and the fact you aren't actually directly trusted. But in practice you will have trust via a cross signature (in this case GoDaddy) so you are trusted, just indirectly - if you screw up that's for real and that's going to be a big deal. Example: m.d.s.policy wants to see what a working secured web site will be like, so you spin up a site which exists only to show that yup, we can issue a correct leaf cert for the site, with a valid expiry date, path leading back to GoDaddy, if testers tell their test system that it trusts $newCA, then it says it's valid from you not GoDaddy, check. Another example: m.d.s.policy wants to see that expiry works properly, so you spin up a site with a two month old certificate but only a month of validity. Except wait, if you're like Let's Encrypt/ ISRG you intentionally don't have manual issuance so you literally need to use your normal automated issuance process and then wait until the certificate expires to show that this works. Let's Encrypt really did this. Twice I think.