Comment by albert_e
13 hours ago
trying to understand where this service is mainly used. judging by a quick google search ...
is this related to Government of India related websites and their services/websites like tax filing etc? is the impact expected to be concentrated around indian citizens availing these services?
The way the web works, any CA (Certificate Authority) can create TLS certificates for almost any website.
This means that the people with these keys could MITM almost any https connection people make, not only the ones that this CA issued.
It doesn't have to, you can set X509 name constraints which say "the CA may only issue/may not issue certificates for these Subjects," or you can set CAA in DNS, for example.
(Of course, the former isn't really intended to constrain trusted Root CAs, moreso internal PKIs. But it is an option people should know about!)
To my knowledge, name constraints are very rare in actual use, and a bunch of implementations don't even support them. Am I wrong?
2 replies →
Yes and NO. These are intermediate CA's and for them to be recognized by your browser or system, they need to be signed by another CA or root certificate that your system already trusts.
SO, not all CA's are signed by root certificates already on your machine
"any CA (Certificate Authority) can create TLS certificates for almost any website."
This has always been incredibly stupid.
You can pin, but almost nobody does (and half the world that does pin is probably pinned to Let's Encrypt).
Those who manage the root domains should have been able to pin who they trust, and then if you WANTED to you could add someone beyond what .com or .egg or .muffin lists.
3 replies →
Why? How do you pin a website to a specific cert provider? And what happens when you want to switch?
4 replies →
It’s used by Indian companies and also they provide digital signature services. It’s a widely used platform.