4 ms·
It's a question of terminology, but when groups like Chrome Security, Mozilla etc talk about MITM certificates and that they are forbidden, we mean those that a
by agl 14y ago
It's a question of terminology, but when groups like Chrome Security, Mozilla etc talk about MITM certificates and that they are forbidden, we mean those that are used for intercepting traffic.
- marshray 14y agoI think this is a case where the precise terminology is critical. The only way to know how a certificate may or may not "be used" is by looking at how the source code of all client applications to see how they will interpret it. How many of the cases of trusted-root chained MITM seen in the wild (Iran, Turkey) were prevented by the business agreements making MITM "forbidden"?