Re:What You Need to Know about HTTP Public Key Pinning (HPKP)
by sjtgraham on Sunday February 07, 2016 @09:54AM
(#11053003)
> A flaw in this system is that any compromised root certificate can in turn subvert the entire identity model. If I steal the Crap Authority's private key and your browser trusts their certificate, I can forge valid certificates for any website.
You don't have to compromise the root. This could still happen if a trusted intermediate CA's private key is compromised, because that CA's certificate was signed by the CA in the chain of trust that ultimately terminates with a trusted root.
Also, how does rfc7469 work with respect to CRLs and OCSP?
You don't have to compromise the root. This could still happen if a trusted intermediate CA's private key is compromised, because that CA's certificate was signed by the CA in the chain of trust that ultimately terminates with a trusted root.
Also, how does rfc7469 work with respect to CRLs and OCSP?