4 ms·
The person you're replying to (Josh Aas) is the head of the largest CA in the world, which has never charged anyone for a certificate and has never made a profi
by schoen 2y ago
The person you're replying to (Josh Aas) is the head of the largest CA in the world, which has never charged anyone for a certificate and has never made a profit. That CA, at least, isn't a money-printing machine!
- paulryanrogers 2y agoGood point. Though being a non-profit doesn't remove the fact that the value proposition of CAs is trust. Perhaps there is some compromise like they just have to submit all issuances certs to a 3rd party, and maintain the last few months worth of issuances.
- schoen 2y agoPart of that compromise is already in effect: https://certificate.transparency.dev/ https://certificate.transparency.dev/
- dontdoxxme 2y agoWhy don’t CT logs include revocations? Seems like that could provide transparency into this without the need for another system (OCSP)
- schoen 2y agoDownloading the CT log is an enormous amount of data, so it addresses a rather different case from the "is this certificate valid right now (because I'm thinking of accepting it)?" question.