4 ms·
Signing another "CA=TRUE" cert seems like it should be a very restricted and audited operation, right? Is it out of the question to say that all such certs shou
by MichaelGG 12y ago
Signing another "CA=TRUE" cert seems like it should be a very restricted and audited operation, right? Is it out of the question to say that all such certs should be cleared by 3rd parties (like Mozilla and MS), on pain of revocation? Or is there a large use case outside of CA infrastructure I'm unaware of?
Google's response here seems a bit weak.
- JoshTriplett 12y agoI would agree; there's really no reason that all major browsers couldn't ship with a complete list of all acceptable CA=TRUE certificates, intermediate or otherwise.
- yuhong 12y agoUnlikely and would cause problems. Parent was suggesting that they should be cleared separately without having to update browsers. I like the certificate transparency idea better though, and I wonder if it is possible to refuse new certs via public endpoints but allow certs to be manually added to the logs and SCTs to be manually issued, in case going that far is needed.
- JoshTriplett 12y agoWhat problems, precisely? Sure, it would prevent current CAs from selling sub-CA certificates without coordinating with browser vendors. That's the point. What's a legitimate use case for doing so?
- yuhong 12y agoYes, but the point is that this "coordinating" can be done without users having to update browsers themselves.
- JoshTriplett 12y agoAll the major browsers have automatic updates these days. And if the coordination doesn't include a browser whitelist, it has no teeth.
- yuhong 12y agoI just edited my comment to mention the certificate transparency solution.
- MichaelGG 12y agoPresumably there's some reason they aren't just don't this already. I mean, I sure hope so otherwise it sounds like a rather big flaw for no reason.