News for hackers. Stuff that matters.

A comment on Let's Encrypt root certificate trusted by Mozilla. Parent comment

Re:Let's Encrypt root certificate trusted by Mozilla by jerf on Friday August 05, 2016 @03:50PM (#12235279)
That's properly understood as a variant of getting a certificate of a domain you don't own, for practical purposes. And the point there is still that the "bad guys" shouldn't be able to get a cert that appears to identify them as Google, not that the bad guys can't get a cert. It's two different things. It is not a bug for Let's Encrypt to hand out certs to "bad" people.
[ Parent | on HN ]
Re:Let's Encrypt root certificate trusted by Mozilla by saynsedit on Saturday August 06, 2016 @03:23AM (#12237386)
That's fair and makes sense. Still, do you have a source for that type of CA policy? With all due respect, I can't tell if this is just your opinion or a codified threat model.
[ Parent | on HN ]