4
Using CAA DNS records for internal networks doesn't really make sense, especially when you're using a .local domain.
Simply put: The way CAA records work is that an issuing CA will check the CAA records of a domain through public DNS records but only if the issuing CA is told to do so.
Public CAS are required to do that. But a public certificate authority ...
3
Frame challenge!
The issue is not with Let's Encrypt. The issue is that SSL has a few purposes, and you are ignoring one of the most important purposes for SSL (which Let's Encrypt is very important for), and have focused on one of the less important purposes. You're not the only one with this confusion though because (truth be told), user's have been ...
3
There are a few different ways:
You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database.
All the major root certificate store maintainers publishes all the root certificate that they have in their root store ...
3
In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.
1) Navigate to security.stackexchange.com, and click the green padlock in the ...
2
Mitigating Effects of Malicious/Compromised Certificate Authorities
There aren't very many things you can do yourself as the client, but I will outline several solutions available anyway.
Remove Untrusted Certificates
If there are CAs that are trusted by your browser and/or operating system that you do not personally trust, you should remove them. This is ...
2
Cross-certification in Windows is done via certreq.exe tool:
certreq -policy <policy.inf> <certtocrosssign.cer> <outreq.csr>
where <policy.inf> is INF file that defines cross-certificate contents and constratints. <certtocrosssign.cer> is a path to a certificate file you are cross-signing. And the last parameter <outreq.csr&...
1
The CAC seems to be a typical smartcard where the private key is stored on the card itself and crypto operations involving the private key like signing are also done on the card. Such smartcards do not allow extraction of the private key. In fact, that is the main purpose of these cards that any use of the private key should explicitly require physical ...
1
Set up a proxy in your organization that handles TLS traffic. (You will need to add your proxy's certificate to all computers in your organization.)
You will then be able to filter traffic at your proxy based on various rules, including the Certificate Authority.
Of course, if you are blocking Let's Encrypt on the principle that they don't do Extended ...
Only top voted, non community-wiki answers of a minimum length are eligible
