Comment by epanchin
12 hours ago
Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters.
12 hours ago
Each CA is like a padlock locked in series with other padlocks. The weakest padlock is the only one that matters.
In a world with CT logs and CAA records, is that actually the case?
Yes, because as we are seeing with this incident, plenty of things don’t check CT logs (and thus can still be hacked if CT isn’t published for bad certs), and CAA records are fundamentally advisory.
You said "yes" but then answered "no"?
Like it seems your disagreement is that you're pointing out there are systems today that trust WebPKI CAs but don't validate CT/SCTs. I'd agree that that's an issue and I want those systems to join the world where CT exists.
As I said, in a world with CAA records and CT logs, this isn't an issue. If your CA wants to be in root trust stores, you have to put your certs in CT logs. CAA records are "advisory" in the sense that we mandate that root-trusted CAs obey CAA records and that they write cert issuance to CT logs, so a trusted CA that violates CAA records has to tell on itself in a very detectable way.
4 replies →