4 ms·
I don't get it. What's the point in keeping the key secret from cloudflare whilst providing a key server signing everything it is asked to sign? Isn't this like
by bifel 12y ago
I don't get it. What's the point in keeping the key secret from cloudflare whilst providing a key server signing everything it is asked to sign? Isn't this like "Sorry I don't trust you enough to provide you a key to my apartment. But if you need something, just ask the janitor, he'll open the door any time you want"?
- wsh 12y agoIf you no longer trust the person, it's easier to tell the janitor not to admit him than to rely on his returning the key (and any copies) or to change the lock on the apartment.
- bifel 12y agoIs "changing the locks" (revoking the certificate) really so complicated that this "janitor-solution" is easier/cheaper/safer?
- wsh 12y agoThe CA can revoke the certificate, but since revocation checking in browsers is neither universal nor reliable under attack, revocation isn't a completely effective way to recover from a compromised private key.
- snowwrestler 12y agoThe more people who have a copy of a key, the more chances for a copy to be lost or stolen by a bad guy.