I think the whole Web PKI needs a do-over, and it can't happen soon enough. I work in software security and design security solutions for and with competent cu

I think the whole Web PKI needs a do-over, and it can't happen soon enough. I work in software security and design security solutions for and with competent customers. In the past couple of years (post Snowden), every design for every one of these customers have been with the assumption that the CA model is broken and can't be trusted - this is a big step. Personally I find the Wildcard SSL certificate a particularily ugly hack for the broken state of the web PKI. Ideally, I should be able to get my own site certificate and use that to sign the server certificates for all my services in my domain. The beauty of this is that my site's private key does not need to be on any on my exposed servers, and I can revoke and re-issue certs for servers individually. This does ofcourse not work, since the certificates aren't limited to domains as such, which correctly is pointed out is a glaring flaw of the entire system. I'm not going to rant about ASN.1 - let's do that another time.