Comment by dist-epoch
16 hours ago
> and no TLS certificates chaining to these CAs ever showed up in CT
Why are browsers trusting CAs which issued zero certificates since their creation 1 year ago?
16 hours ago
> and no TLS certificates chaining to these CAs ever showed up in CT
Why are browsers trusting CAs which issued zero certificates since their creation 1 year ago?
These are intermediate roots, signed by trusted root certs, so the trust from your OS or browser is implicit to the roots it trusts.
At this point, I think it'd be reasonable to start saying "why do we trust intermediate roots, period".
Yes, but there was no TLS cert issued that had these intermediate certs in its chain of trust at all anywhere. So why are they a CA if they don't issue any certs?
Their other intermediates have issued certs.