News for hackers. Stuff that matters.

A comment on Around 293 intermediate CAs in violation of CA/Browser guidelines. Parent comment

Re:Around 293 intermediate CAs in violation of CA/Browser gu... by zenexer on Monday July 06, 2020 @09:36AM (#23747706)
They definitely should be—that’s what the author is claiming is mandated, and it would make sense. However, I’m a bit skeptical about browsers being able to enforce that timeline here.

Also, given that the underlying cause appears to be ignorance, it would be prudent to take things slow and ensure that this doesn’t happen again. As I said before, the damage is already done—revoking appears to be insufficient here.

If this does actually happen within 7 days, though, I will be thoroughly impressed.

[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by floatingatoll on Monday July 06, 2020 @10:09AM (#23747999)
It could be considered a tacit warning that browsers may choose to mistrust the impacted subCAs in the near future. I don’t know the specifics, but I assume they can revoke for non-compliance using in-browser mechanisms without depending on the revocation process.

EDIT: Mozilla’s reply: https://news.ycombinator.com/item?id=23748561

[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by tptacek on Monday July 06, 2020 @03:55PM (#23752024)
You don't have to trust Sleevi (though: you always should); you can just read the BRs. The revocation requirement is in this case black-letter SHALL.

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...

[ Parent | on HN ]