alt Hacker NewsWhy was anyone using certificates from a little known company with no cybersecurity muscle?
Replies
Worse yet, why is that CA even part of the Root CAs shipped on all the modern devices?
My trust in those vetting the CAs is completely broken now.
It might have been little-known in your corner of the world, but I understand it's definitely not little-known in India.
You might have heard of DigiCert or IdenTrust, but what, exactly, makes them trustworthy, and why eMudhra wouldn't be considered trustworthy (a week ago)?
You might have heard of this "sovereignty" movement: sovereign OS, sovereign cloud, sovereign AI?
One man's "little known company with no cybersecurity muscle" is another one's "sovereign certificate infrastructure."
It mostly does not matter. They don’t have your private key, and EVERY trusted CA can miss-issue in your name, regardless of who you pick.
That’s sort of the problem the CA forum (badly) addresses. The consumers of the CAs are not specifically exposed to failures of the CA they choose.
Web PKI doesn't work like you think it does. I can use eMudhra's private keys to forge a cert for your website. You don't have a choice in this.