4 ms·
I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but i
by ryao 2y ago
I remember people promising a rogue CA would not work anymore due to certificate transparency requiring certificates to be published in order to be valid, but it is quite obvious here that certificate transparency was not even needed. A private CA is different from a rogue CA, but if the private CA was not forced to do certificate transparency, I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”.
- vlovich123 2y ago> I wonder what is supposedly forcing the public CAs to do it for their certificates to be “valid”. The power of browsers and operating systems including the cert in the default store distributed to everyone. Participating in cert transparency is a requirement.
- ryao 2y agoHow is that enforced as it was billed as certificates are not valid unless published, yet it is obvious certificates for a private CA are not being published and are treated as valid?
- vlovich123 2y agoAs I understand it there are various interested parties who monitor to make sure that the default CAs in the root store publish to the certificate transparency before they sign anything. A violation would be grounds for immediate removal. None of this applies to a private CA you add to your own store.