3 ms·
Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
by cookiengineer 3y ago
Wait until you find out where CA certificates come from. The answer is: E-Mail and a public salesforce instance.
- 8organicbits 3y agoYou're talking about issuing certificates via email? That's a widely documented process, I've used it. SharePoint... I'm not familiar with. I'd love a reference. Certificate issuance doesn't need to be perfect. We have Certificate Transparency, for example to catch missisuance and CAA records to restrict the process.
- cookiengineer 3y agoI talk about the CCADB: [1] https://www.ccadb.org/ https://www.ccadb.org/ [2] https://www.ccadb.org/resources https://www.ccadb.org/resources
- deleted 3y ago[deleted]
- 8organicbits 3y agoAh, you're not talking about issuance. I think you're implying that the browsers blindly copy their trust roots from the linked Salesforce site, and you don't think Salesforce provides suitable tampering protection. I'm not shocked? The website discusses audit responsibilities quite a bit, which seems like it mitigates tampering concerns. Sure I'd prefer something other than Salesforce too, but I'm not seeing a glaring issue here.
- taskforcegemini 3y agocan you elaborate on that? Certificates are usually public anyway, but the matching private keys aren't. CAs usually have them on hsm-devices only. if you mean private keys are shared via email: keys from the CA-Certs, or just from the Certificates the CA signed? for instance, getting a CA publicly into a browser is expensive and requires audits, so your experience makes me curious