3 ms·
I'd classify that as very low risk. If a CA's business is compromised by a government, then it's pretty easy to just switch to using a different CA, preferably
by ndsipa_pomu 2y ago
I'd classify that as very low risk. If a CA's business is compromised by a government, then it's pretty easy to just switch to using a different CA, preferably in a different jurisdiction to work around the censorship.
I don't really get the argument behind using HTTP links to avoid the censorship risk with HTTPS - just provide both and get the best of both worlds. Also, using HTTP is far more prone to being interfered with in transit - I recall BT (or their ISP business department) trialling that and injecting adverts into HTTP pages. I can't recall any instance of HTTPS being censored by restricting certificates.
- hulitu 2y ago> I'd classify that as very low risk. The majority of CAs are in the US.
- ndsipa_pomu 2y agoWhilst that could be a problem, there are some CAs that aren't based in the US. I consider it a low risk issue as I haven't heard of it happening. It'd be more likely for your IP to be cut off rather than attempting to deny an SSL cert.
- yugcesofni 2y agoFWIW, a slight clarification here would be that the majority of TLS certificates are issued by CAs in the US, but the majority of CAs are not headquartered in the US.