Re:Microsoft silently adds Amazon root certificates to its CTL
by svenfaw on Friday January 22, 2016 @05:07AM
(#10951849)
Indeed they are cross-signed with a Starfield root, so I wonder, what would be the point of adding them natively? Are there any benefits to that?
[ Parent
| on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL
by FiloSottile on Friday January 22, 2016 @05:12AM
(#10951868)
Eventually, once the roots are trusted natively in enough systems, dropping the cross-signed root, making handshakes smaller and path-building simpler. Also some of their roots are stronger than the cross-signer, so when/if the cross-signer becomes too weak and gets dropped, the better Amazon roots will stay.
And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.
Re:Microsoft silently adds Amazon root certificates to its CTL
by vtlynch on Friday January 22, 2016 @09:10AM
(#10952758)
>And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.
Just to clarify on your last point. If Amazon wants to issue certificates it has to conform to industry regulations and undergo audits regardless of if its using another companies' roots.