3 ms·
As in, revoking a cert for a known C&C box, or a confirmed spammer, confirmed box serving an exploitkit, confirmed phishing domain (such as my-apple-ikloud-veri
by xxdesmus 12y ago
As in, revoking a cert for a known C&C box, or a confirmed spammer, confirmed box serving an exploitkit, confirmed phishing domain (such as my-apple-ikloud-verify.foo)
Basically, my assumption is they won't want to be providing certs to known bad actors. So I'm curious who is going to own the abuse handling for the CA.
- duskwuff 12y agoIs that really something a SSL CA should be responsible for? I'd argue it isn't. An SSL certificate is proof of identity (and even that only in a very limited sense), not of legitimacy.
- belorn 12y agoThose issues are in theory handled by taking down the people who commits it, and in practice by taking down the domain names, since those normally has been registered using false credentials. One can hope/assume that this system will automatically revoke domains that expire or get removed.
- Dylan16807 12y agoNo reason bad actors can't be encrypted on the wire just like all the other actors.