3 ms·
I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then
by gojomo 12y ago
I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point.
(It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)
- TazeTSchnitzel 12y agoIt is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.
- takluyver 12y agoKomodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works: http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cert_creation http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
- patcheudor 12y agoI wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache: http://webcache.googleusercontent.com/search?q=cache:XUbVSX81n_YJ:www.komodia.com/wiki/index.php%3Ftitle%3DSSL_Digestor+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...
- patcheudor 12y agoIt's TRUE, confirmed, and replicated by others. See my other post to this parent. And you are correct, this is worthy of another scary explicit bullet point!