5 ms·

So should we conclude that SSL cert infrastructure is completely compromised and now any country can issue fake certificates?

• blueflow 3y ago
  No, there is no reason to jump to such extremes.
  • codedokode 3y ago
    There are approximately 10 Tier-1 ISPs through which majority of Internet traffic passes, and unless I misunderstood something, they can issue valid certificates for almost any domain. To me it looks like "completely compromised".
    • blueflow 3y ago
      Every CA can issue valid certificates for every domain? And it always has been that way.
      • codedokode 3y ago
        CA has a risk to get their root cert removed from browsers; ISP doesn't risk anything especially when asked by the govt.
        • blueflow 3y ago
          They risk having their peerings cancelled. Also it might be a crime in some countries.