| ▲ | throwaway7356 2 hours ago |
| > even ones it has no right signing They have that right though? There is no monopoly to single CAs for a given domain. |
|
| ▲ | cpburns2009 an hour ago | parent [-] |
| Why should podunk CAs be trusted by default to sign google.com when that's not their intended purpose? |
| |
| ▲ | throwaway7356 an hour ago | parent [-] | | Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains. | | |
| ▲ | VMG 15 minutes ago | parent [-] | | Right but there are probably 100-1000 important domains and a long tail of less important ones |
|
|
