Certificate Authorities and the Fragility of Internet Safety

Re:Certificate Authorities and the Fragility of Internet Safety by constGard on Wednesday December 04, 2024 @08:27PM (#42323888)

If I were interested in assembling an authoritative, up-to-date list of trusted CAs, would be reasonable to source lists from the major trust store providers and select only those CAs trusted by all of them? I know it's possible to be a lot more sophisticated and that even that can be flawed, but I'm hunting for a simple-to-follow criteria for now.

[ Parent | on HN ]

Re:Certificate Authorities and the Fragility of Internet Safety by woodruffw on Wednesday December 04, 2024 @08:57PM (#42324041)

The CCADB tracks the various root programs, so you could do this today[1]. In practice however I think you’d be best off just using the Mozilla root program; I believe they’re as (if not more) strict than the corporate root programs in terms of inclusion.

[1]: https://www.ccadb.org/

[ Parent | on HN ]

Re:Certificate Authorities and the Fragility of Internet Safety by ryukoposting on Wednesday December 04, 2024 @09:40PM (#42324255)

Sounds like we need a certificate authority authority.

[ Parent | on HN ]

Re:Certificate Authorities and the Fragility of Internet Safety by tptacek on Wednesday December 04, 2024 @10:12PM (#42324472)

They exist: they're the Google and Mozilla root programs.

[ Parent | on HN ]

Re:Certificate Authorities and the Fragility of Internet Safety by BobbyTables2 on Wednesday December 04, 2024 @09:59PM (#42324367)

Bickering will just result in having multiple authorities.

This can be solved with a certificate authority authority authority.

The first will be named CARTMAN and must be respected by all.

[ Parent | on HN ]

Re:Certificate Authorities and the Fragility of Internet Safety by bigiain on Wednesday December 04, 2024 @11:07PM (#42324863)

I propose:

  public class CertificateAuthorityFactory{

[ Parent | on HN ]