Comment

Comment by agwa

Browsers enforce Certificate Transparency by rejecting certificates which aren't published in CT logs. A certificate that is published in CT logs isn't necessarily legitimate, but at least it's public so domain owners can detect it and raise the alarm if the certificate is illegitimate.

Unfortunately, Article 45 states that certificates issued by EU-mandated CAs "shall not be subject to any mandatory requirements other than the requirements laid down in paragraph 1" and paragraph 1 does not allow browsers to reject certificates not published in CT logs.

Thus, EU-mandated CAs will be able to issue undetectable MitM certificates.

parent agwa 3 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton