11–20 of 116 posts
Earlier quoted context omitted.
[deleted]
I believe this is done by not accepting any certificate issued past date X. This way the old certificates keep working, while the new ones don't.
https://groups.google.com/d/msg/mozilla.dev.security.policy/...
Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…
+1 revoking a CA using the issuance date seems like the right solution
But prior to March 2015, CAs could issue certs valid for up to 5 years. So even if browsers stopped accepting WoSign certs with an issuance date after today, WoSign could still issue certs "issued March 2015 valid until to March 2020" and browsers would accept them.
> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…
I just went to delete these roots from my Windows system but it's not listed. It was in Firefox's list but not in Window's. Anyone know why?
Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…
Earlier quoted context omitted.
+1 revoking a CA using the issuance date seems like the right solution
It would certainly be better than nothing, yes. But prior to March 2015, CAs could issue certs valid for up to 5 years. So even if browsers stopped accepting WoSign certs with an issuance date after today, WoSign could still issue certs "issued March 2015 valid until to March 2020" and browsers would accept them.
> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
Wosign is not in the list of default CAs on the Mac, according to Keychain, so if you are using Chrome on a Mac, since Chrome only uses the system's root certs, you should be safe as long as you don't go add that root cert into Keychain. Wosign is in Firefox however, so Mozilla needs to do something about this.
Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…
thing is the whole castle is built upon trust.
if you don't punish crap CA and ppl who don't do research first, things will deteriorate rapidly.