Startcom CA applies for inclusion in Mozilla

Re:Startcom CA applies for inclusion in Mozilla by michaelt on Tuesday August 01, 2017 @11:36AM (#14901817)

  are there any real reasons why we don't have critical
  name constraints to countries' TLDs?

The reasoning I've heard is that .cn users' security requirements aren't any lower than .com users' security requirements. i.e. if startcom/Qihoo360 aren't good enough to issue .com, they're not good enough to issue .cn

[ Parent | on HN ]

Re:Startcom CA applies for inclusion in Mozilla by ameliaquining on Tuesday August 01, 2017 @11:57AM (#14902088)

Yeah, but reducing the number of CAs that are trusted for any given domain is likely positive.

I'm also curious as to how the Chinese government plays into all this. Do they have a track record of making trusted CAs misissue certificates?

[ Parent | on HN ]

Re:Startcom CA applies for inclusion in Mozilla by Ajedi32 on Tuesday August 01, 2017 @12:25PM (#14902420)

> Do they have a track record of making trusted CAs misissue certificates?

Probably not. Any CA missisuing certs intentionally (whether by government coercion or not) probably wouldn't remain trusted for long. So if the Chinese government is doing something like that, the public is certainly not aware of it, else there wouldn't be any Chinese CAs left that are still trusted.

[ Parent | on HN ]

Re:Startcom CA applies for inclusion in Mozilla by baby on Tuesday August 01, 2017 @08:01PM (#14906659)

That's the beauty of the trust store. The PKI might be a fucked up solution to our trust problem on the internet, but it puts enough pressure against governments to throw them away.

[ Parent | on HN ]

Re:Startcom CA applies for inclusion in Mozilla by baby on Tuesday August 01, 2017 @08:00PM (#14906654)

I've heard that some countries' CA tend to misbehave more than others, that would help.

[ Parent | on HN ]