News for hackers. Stuff that matters.

A comment on Kazakhstan to MitM all HTTPS traffic starting Jan 1.

Re:Kazakhstan to MitM all HTTPS traffic starting Jan 1 by rakslice_ on Wednesday December 02, 2015 @08:01PM (#10667042)
This is lame news. But what I'm curious about is: What are they going to do (if anything) to validate the upstream certificates?

- What will their upstream root certificate policy be?

- If they MITM any old upstream certificate, how will they mitigate the huge target they are painting on Kazakh Internet users?

[ Parent | on HN ]
Re:Kazakhstan to MitM all HTTPS traffic starting Jan 1 by peeters on Wednesday December 02, 2015 @10:44PM (#10667623)
I would assume their root trust store could be similar to what your browser would use. i.e. a curated set of root CAs with CRL subscription.
[ Parent | on HN ]