Tag Info

New answers tagged

1

(Edit 2014-11-25: Reworded flushed out to phased out.) Short answer: From what I can tell, they will be gracefully phased out, not flushed out. (At least by Microsoft.) The old SHA1 root certs will expire regularly and Microsoft will no longer accept NEW SHA1-roots starting 2016. The old ones will stay in I guess, since they were compliant to the guidelines ...


1

If you want to do that install Firefox. Firefox comes with its own trusted CA store and what you add there will only be available to Firefox.


0

Unfortunately, X.com cannot sign Y.com for security purposes. Take the following example: Mallory is trying to perform a MITM attack on Alice and Bob. He owns a valid certificate signed by Verisign for Z.com. Alice sends the valid certificate for X.com to Bob, signed by Verisign. Mallory intercepts that connection, signs a certificate for X.com with his ...


1

While there doesn't appear to be any existing privacy-friendly CAs at this moment, all evidence suggests that the recently-announced Let's Encrypt CA (launching summer 2015) will not require users to provide personal information. This could change, but I doubt it will given EFF's involvement. If Let's Encrypt will not collect any personal information when ...


2

Not only will they not issue new certificates for unvalidatable IPs, but also revoke them in 2016. https://www.digicert.com/internal-names.htm As from 1 October 2016, CAs shall revoke all unexpired Certificates. More info in Mozilla's Wiki: CA:Problematic_Practices#Certificates_referencing_hostnames_or_private_IP_addresses


2

For public IP it must be checked that the IP is actually owned by the one who requests the certificate. Issuing certificates for private (reserved) IP is deprecated because obviously the ownership cannot be checked. For more information see CA baseline requirements Sect 9.2.1.



Top 50 recent answers are included