4 ms·
It's possible that this was just a slight imprecision of language, and the thing being inspected is the CSR rather than the actual certificate. (But the point a
by ameliaquining 1y ago
It's possible that this was just a slight imprecision of language, and the thing being inspected is the CSR rather than the actual certificate. (But the point about individual certificates/CSRs being unworthy of human attention is totally right.)
- tialaramex 1y agoThat's true, although inspecting a CSR is also daft because much of the CSR is actually ignored by the CA so you can "check" it but if it was "wrong" that makes absolutely no difference to anything. The CA is going to look at the requested names (to check they were authorized) and they'll also copy the requested public key, this combination is what's certified. But if your antiquated gear spits out a CSR which also gives a (possibly bogus) company name and an (maybe invalid) street address "checking" that won't matter because the CA will just throw it away, the certificate they issue you isn't allowed to contain information they didn't check, so that part of your CSR is just tossed away without reading it.
- syncsynchalt 1y agoThere are CAs which to this day have been caught issuing certs that don't match CSRs, because the CA uses a manual process of hand-copy or hand-typing fields from the CSR into the new certificate. So even reviewing CSRs won't help you. (The solution of course is to automate your cert request/issuance, which has the side effect of ensuring no human is involved in the cert process)