4 ms·
I wasn't sure it if it was reliable. I remember during the last "ca leaks root cert" fiasco there was talk about how browsers don't implement this securely.
by kevinpet 14y ago
I wasn't sure it if it was reliable. I remember during the last "ca leaks root cert" fiasco there was talk about how browsers don't implement this securely.
- ajross 14y agoRight, but that's different. That was a root certificate that was compromised: something you can use to make new certs. The basic certs themselves can be revoked, and are fairly routinely. There is always a root of trust in a cert scheme (vs. a web scheme, say, which has no single point of failure but a squishier notion of validity). The reason it got caught is that Chrome implemented an independent "pinning" feature for Google's own domains (basically an independent root of trust) and caught the fraudulent certs.