2 ms·

Observation: If a Certificate Authority (CA) is down or unreachable over the Internet for whatever reason -- then effectively all transactions which require tha

Observation: If a Certificate Authority (CA) is down or unreachable over the Internet for whatever reason -- then effectively all transactions which require that CA to work are down as well... If all CA's are simultaneously down or unreachable -- then effectively any protocol that requires a CA -- is also down... This includes SSL, TLS, and everything which requires HTTPS to work -- not just all HTTPS web pages -- but all HTTPS web services as well... A "single point vulnerability" indeed!

ShadowRegent 4y ago
A CA doesn't need to be online for HTTPS to work. If it's offline, it won't be able to issue new certificates, but existing ones will be just fine. In fact, Root CAs are often kept offline as a best practice to limit their exposure.
- peter_d_sherman 4y ago
  I stand corrected! My original cursory understanding of HTTPS -- was that it required SSL/TLS to make it work, which in turn required CA's issuing certificates and the validation of those certificates to make that work... Now, all of the above is true -- but the subtle distinction that I realized after reading your comment (and performing more subsequent research on the matter) -- was that everything above is (apparently -- based on the best knowledge from the research I've done at this point in time!) based on local Root Certificates whose data is contained in local files (i.e., no need to reach out to a CA server for validation) which act as the "Trust Anchor" for all other SSL/TLS certificates... I.e., new certificates handed to a user's browser by a new website -- do not need to be validated by making an Internet connection to the CA and asking that the CA validate them -- instead, they are validated using cryptographic hashing techniques against the user's local CA Root Certificates... These CA Root Certificates are apparently X.509 certificates -- or follow that format: https://en.wikipedia.org/wiki/X.509 https://en.wikipedia.org/wiki/X.509 Now, that's a good thing! It means that there's no dependency (one less point of possible failure) that a CA be up and running -- for all of those HTTPS/TLS/SSL transactions to work... So, you are correct -- and I stand corrected!
  - toxypol 4y ago
    spend less time in the comments section and more time building bro
    - peter_d_sherman 4y ago
      Question #1: Building what exactly, "bro"? Question #2: How would that change anything? Question #3: How do I know that you're not: a) A GPT-3 or other AI powered chat bot? b) A Troll? c) A paid disinformant and/or propagandist and/or someone else with an agenda -- foreign or domestic? ? Question #4: What value do you genuinely believe your comments add to the discussion? ?

ShadowRegent 4y ago

A CA doesn't need to be online for HTTPS to work. If it's offline, it won't be able to issue new certificates, but existing ones will be just fine. In fact, Root CAs are often kept offline as a best practice to limit their exposure.

peter_d_sherman 4y ago
I stand corrected! My original cursory understanding of HTTPS -- was that it required SSL/TLS to make it work, which in turn required CA's issuing certificates and the validation of those certificates to make that work... Now, all of the above is true -- but the subtle distinction that I realized after reading your comment (and performing more subsequent research on the matter) -- was that everything above is (apparently -- based on the best knowledge from the research I've done at this point in time!) based on local Root Certificates whose data is contained in local files (i.e., no need to reach out to a CA server for validation) which act as the "Trust Anchor" for all other SSL/TLS certificates... I.e., new certificates handed to a user's browser by a new website -- do not need to be validated by making an Internet connection to the CA and asking that the CA validate them -- instead, they are validated using cryptographic hashing techniques against the user's local CA Root Certificates... These CA Root Certificates are apparently X.509 certificates -- or follow that format: https://en.wikipedia.org/wiki/X.509 https://en.wikipedia.org/wiki/X.509 Now, that's a good thing! It means that there's no dependency (one less point of possible failure) that a CA be up and running -- for all of those HTTPS/TLS/SSL transactions to work... So, you are correct -- and I stand corrected!
- toxypol 4y ago
  spend less time in the comments section and more time building bro
  - peter_d_sherman 4y ago
    Question #1: Building what exactly, "bro"? Question #2: How would that change anything? Question #3: How do I know that you're not: a) A GPT-3 or other AI powered chat bot? b) A Troll? c) A paid disinformant and/or propagandist and/or someone else with an agenda -- foreign or domestic? ? Question #4: What value do you genuinely believe your comments add to the discussion? ?