Re: Let's Encrypt makes certs for 30% of web domains
by kanox on Friday September 06, 2019 @06:10PM
(#20900344)
What exactly happens if a CA is compromised (private keys stolen etc)? Wouldn't existing certificates before the compromise date still be valid?
[ Parent
| on HN ]
Re: Let's Encrypt makes certs for 30% of web domains
by kakwa_ on Saturday September 07, 2019 @06:26AM
(#20902933)
If a CA is compromised critically (private key stolen), then it's removed from the set of trusted CAs you can find in browsers or at OS level (ex: ca-certificates package on Ubuntu/Debian), which in turn makes all the certificates the CA has signed invalid.
With multiple signatures, at least, your certificate is still valid as it has at least another valid CA signature.
Also, right now, if one CA is compromised and if this goes unnoticed, the effect is a bit catastrophic as it's possible to create valid certificates for any domain. With multiple CA signatures in conjunction with a security policy mechanism stating how many of these signatures must be valid, you mitigate this issue as it would require several CAs to be compromised and controlled by the same actor to issue valid certificates.
Re: Let's Encrypt makes certs for 30% of web domains
by albertsondev on Friday September 06, 2019 @07:10PM
(#20900690)
That's precisely the benefit of requiring a multitude of CA signatures -- no single compromise is capable of having a catastrophic impact.