3 ms·
If more than one signature was allowed on a certificate, then sites would be able to have more than one path to the root. Then it wouldn't matter if any single
by jpollock 12y ago
If more than one signature was allowed on a certificate, then sites would be able to have more than one path to the root. Then it wouldn't matter if any single CA was removed, giving people time to obtain new signatures.
- graylights 12y agoAgreed, but I think it should go a step further. Browsers should require 2 signatures from different regions. That way a government can't pressure a single CA within their borders to issue rogue certs. 2 signatures would be minimum with 3 for redundancy.
- AlyssaRowan 12y agoAgreed: this is a major operational flaw with deployed PKIX. It has many unintended consequences, for example it's especially a pain with UEFI Secure Boot.