News for hackers. Stuff that matters.

A comment on Automate Public Certificates Lifecycle Management via RFC 8555 (ACME). Parent comment

Re:Automate Public Certificates Lifecycle Management via RFC... by iancarroll on Tuesday April 12, 2022 @02:05AM (#30999158)
The private companies that do have incidental root certificates in trust stores, like Visa, are endemic sources of compliance issues.

If any company should operate a CA, it should probably not be random enterprise companies.

For one example: https://wiki.mozilla.org/CA:Visa_Issues

[ Parent | on HN ]
Re:Automate Public Certificates Lifecycle Management via RFC... by shartte on Tuesday April 12, 2022 @04:20AM (#30999958)
I think the parent poster meant that if X.509 Name Constraints were widely deployed, Visas CA could be limited to Visa's TLD+1s. In the same way, government affiliated CAs could be limited to their own country TLDs, or a development CA could be limited to localhost.
[ Parent | on HN ]