Comment by drdexebtjl

20 hours ago

When is Sectigo, the root CA that cross-signed the vulnerable intermediate CAs, going to take responsibility for fucking up too? Why should we keep trusting them?

4 comments

drdexebtjl

Reply
kensey  18 hours ago

eMudhra was a root CA. Their roots and intermediates were cross-signed by Sectigo since it was a new(-ish) root CA (a comment on Reddit characterized eMudhra as a Sectigo reseller, but I can't find verification of that), but I don't know to what extent that was done as a result of Sectigo's own evaluation vs. some internal process of a larger entity like the CA/Browser Forum. (Without cross-signing, it's difficult for a new CA to operate, so I imagine there must be some process by which a particular existing-CA cat is belled to be the cross-signer.)

  • drdexebtjl  18 hours ago

    I was referring to Sectigo. Edited to make it clearer.

    • kensey  15 hours ago

      I'm not sure (but would love to know) if Sectigo actively chose to sign eMudhra's certs (though if eMudhra is a reseller of theirs, it would make sense to do so), or if maybe it was just "their turn in the barrel" to be the designated cross-signer of a new CA's certs so the new CA could be a useful entity.

      1 reply →