Re:How to distrust a CA without any certificate errors
by lxgr on Thursday March 06, 2025 @07:04PM
(#43286303)
tl;dr: By using the CT logs as a trusted timestamping service, if I understand it correctly?
[ Parent
| on HN ]
Re:How to distrust a CA without any certificate errors
by tptacek on Thursday March 06, 2025 @07:59PM
(#43286587)
More broadly, because longstanding universal adoption of CT makes it possible for root programs to grandfather in older certificates, so that they can axe a CA without generating SSL errors for all that CA's existing certificates, which is something they couldn't do before.