#x509 — Public Fediverse posts

RE: https://abyssdomain.expert/@filippo/117478838791731289

I'd say that the problem came about as people thought it's a good idea to have a list of arbitrary* CAs that can certify each and every name in the whole world. And instead of fixing it introduced one workaround after the other (e.g. CT logs).

• Yes, yes. They must undergo auditing, etc. But the procedure is a pure compliance circus as this very incident shows.

#webpkit #pki #dns #x509 #emudhra

In a parallel world browsers and service providers alike are using DANE and you wouldn't have even known if a random CA was compromised or not.

#ca #pki #x509 #dnssec #dane