Re:Shortening the Let's Encrypt Chain of Trust
by jart on Monday July 10, 2023 @10:23PM
(#36675721)
I like to build portable static executables, so I embed the CA roots in every executable I build that needs to talk HTTPS. It'd be great if there weren't so many mom and pop shops in the certificate authority business. It just boggles my mind how the Internet hasn't fallen apart, considering the only thing you have to do is compromise something like a printing shop in France.
[ Parent
| on HN ]
Re:Shortening the Let's Encrypt Chain of Trust
by asadotzler on Monday July 10, 2023 @11:18PM
(#36676048)
Well, it takes a bit more than that to get into any meaningful distribution.
Re:Shortening the Let's Encrypt Chain of Trust
by jart on Tuesday July 11, 2023 @12:04AM
(#36676292)
If that were true, then it wouldn't have happened.
Re:Shortening the Let's Encrypt Chain of Trust
by NoZebra120vClip on Tuesday July 11, 2023 @12:05AM
(#36676300)
I currently run Android 11, and I went through a while ago and disabled any CAs that were hinky or I didn't like what nation they were associated with. AFAICT, there was nothing at all that broke after I disabled so many of these trust anchors. I am not sure if the GP is saying that bundled root CAs can override OS-supplied trust anchors, particularly any which have been manually and administratively disabled, but that would be a disturbing, yet helpful, thing to know.