4 ms·
I'm curious: What's the defense mechanism for a dodgy CA not publishing a CT log entry for the misused domain?
by thrtythreeforty 3y ago
I'm curious: What's the defense mechanism for a dodgy CA not publishing a CT log entry for the misused domain?
- woodruffw 3y agoA CT-honoring client should reject an end-entity certificate that isn't accompanied by a SCT. In other words: a dodgy CA that skips CT to avoid disclosure of their mis-issued certificate should be unable to convince any CT-honoring client to accept that certificate.