2 ms·
> Do you really trust the turkish government with the ability to sign for any domain. No, but I don’t have to. To be included in the root CA list, they have to
by snowwrestler 3y ago
> Do you really trust the turkish government with the ability to sign for any domain.
No, but I don’t have to. To be included in the root CA list, they have to participate in cert transparency logging. So I can just pick a log to monitor, and check to make sure they haven’t issued a cert for one of my domains.
- somat 3y agoSo you don't trust them to not issue an unexpected cert but you do trust them to always log it? edit: I just read the spec. the cert needs to be logged to be considered valid by the browser. which has fun connotations where google is effectively monitoring everything you access. basically the mother of all analytics. well... I mean... that is.. if they were not already monitoring everything you do on the web. so it's ok I guess.