News for hackers. Stuff that matters.
Re:How to distrust a CA without any certificate errors by lxgr on Thursday March 06, 2025 @07:04PM (#43286303)
tl;dr: By using the CT logs as a trusted timestamping service, if I understand it correctly?
Re:How to distrust a CA without any certificate errors by tptacek on Thursday March 06, 2025 @07:59PM (#43286587)
More broadly, because longstanding universal adoption of CT makes it possible for root programs to grandfather in older certificates, so that they can axe a CA without generating SSL errors for all that CA's existing certificates, which is something they couldn't do before.