4 ms·
I kinda see what you're getting at, but that wouldn't fix anything. If I interpret what you want correctly, you basically want a cert that is dual-signed by mul
by cheald 13y ago
I kinda see what you're getting at, but that wouldn't fix anything. If I interpret what you want correctly, you basically want a cert that is dual-signed by multiple CAs which would be under different political jurisdictions. It's a clever idea, but it's not really usable. Clients validate that they trust a member in the signing chain, not all members in the signing chain, so as soon as the browser encounters a signing authority that it trusts, it will trust the cert.
Furthermore, this wouldn't really stop a bad actor from getting a cert signed by a third CA which your browser trusts and MITMing it to you, unless you're cert pinning, which practically nobody is because it comes with a tremendous list of user experience issues.