News for hackers. Stuff that matters.

A comment on Microsoft silently adds Amazon root certificates to its CTL. Parent comment

Re:Microsoft silently adds Amazon root certificates to its CTL by cm2187 on Friday January 22, 2016 @04:03AM (#10951630)
In a way it's broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can't allow to fail, otherwise we break the internet.

I wonder if we shouldn't adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let's encrypt for commercial certificates.

[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by icebraining on Friday January 22, 2016 @04:20AM (#10951696)
I think that's one of the goals of Let's Encrypt, by developing the ACME protocol, which will be submitted as a standard RFC: https://ietf-wg-acme.github.io/acme/
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by realusername on Friday January 22, 2016 @04:11AM (#10951661)
A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.
[ Parent | on HN ]