← Back to context

Comment by Insimwytim

3 hours ago 

  Most non-browser TLS clients (so basically everything else, with default settings), things like curl, Python, Node, Go, Java, git, package managers and every script and daemon you've got, do three things that matter here: they trust a CA bundle on disk, they don't check revocation by default, and they don't check CT. So the fact that eMudhra and Sectigo have revoked these intermediates doesn't help them at all. [1]

[1] https://news.ycombinator.com/item?id=50177916 )

0 comments

Insimwytim

Reply