Re:Room 641A
by thr0w3345 on Friday May 29, 2020 @05:11PM
(#23355601)
But that would only allow them to sign new certs, CA’s don’t get the private keys only the public part to sign... Or did I misunderstand you?
[ Parent
| on HN ]
That's correct. To sniff traffic without replacing the certificate with one of their own they would need the the private key which was used in a session. (That key might have been derrived from the server private key, but again nothing the CA has access to.)