3 ms·
CAs do have private keys. Otherwise, what is the public key that I see on the Entrust Root CA related to? (The CA at the root of the hierarchy that issued HN's
by stygiansonic 13y ago
CAs do have private keys. Otherwise, what is the public key that I see on the Entrust Root CA related to? (The CA at the root of the hierarchy that issued HN's certificate)
But you're correct that even if the NSA got the CA's private key, they could only "forge" certificates and this would be detected by certificate pinning. (Similar to the Comodo/Digitnotar compromises)