3 ms·

> every web browser in the world will be forced to trust the root certificates from all European Trust Service Providers What I could never understand is why l

by usrnm 3y ago

> every web browser in the world will be forced to trust the root certificates from all European Trust Service Providers What I could never understand is why limiting the scope of root certificates is not a standard feature? Why cannot I set a whitelist of domains for the specific root certificate and expect the connection to fail when this root is used for anything else?

arpa 3y ago
You can using a CAA DNS record.
- usrnm 3y ago
  Not really. That's still something the owner of the domain has to do. What I'm talking about is a setting in the browser that lets me as a user decide what root certificates I want to trust and for what. Why can't I do that?