3 ms·
Indeed, it looks like that's a bug in the SSL labs rating scheme: given two trust paths, it takes the longer one. The Baltimore root is trusted, but also signe
by brians 13y ago
Indeed, it looks like that's a bug in the SSL labs rating scheme: given two trust paths, it takes the longer one.
The Baltimore root is trusted, but also signed by the old GTE 1024-bit root. It's not clear to me what harm it does to have an appendix of old roots above a well-managed, trustworthy trusted root.
- ivanr 13y agoNo, the issue is not with the trust paths. The old 1024-bit root is in Mozilla's trust store, where it's a danger to everyone. SSL Labs reuses their store, which is why the weak root shows up in the trust paths. Technically, the F for blogs.akamai.com was a bug (now corrected; the grade after the fix is C). I say "technically" not because I approve of export cipher suites, but because the implementation did not follow the documentation (the rating guide, linked from every report). Export suites are hopelessly weak and will be treated more harshly in the next guide revision. The new grade is certainly not something to be happy about.