On Mon, Sep 21, 2009 at 6:29 PM, Jeffrey I. Schiller <[email protected]> wrote: > On Mon, Sep 21, 2009 at 08:41:36PM +0200, Robert Kisteleki wrote: >> I'm sorry for pointing out the obvious, but in _any_ system where you >> receive a certificate from someone else -- like it or not -- that someone >> else will have the means of revoking your cert, or not renewing it. As >> simple as that. It can be an error, a bug, and (horrible dictu) abuse of >> power, the real cause ultimately doesn't really matter. > > But in the currently deployed PKI for web certificates, you have a > choice of CA’s. If one is abusing you (makes too many errors, etc.) > you can switch to another. They are all “equal” in the end user’s > browser (I won’t go into EV certs here, that is a whole different > kettle of fish).
sure, and as it happens you can also have more than one certificate for mozilla.com .... which is 'bad'. > I believe the competition between CA’s helps level the playing field > between those issuing certificates and those purchasing them. I'm not sure that's the case, since I can go to startssl.com and get a cert for free that's good for 1yr and doesn't raise exceptions in +98% of the user base... or I can go to verisign get the same thing for 1k$. I'm also not sure that the web-ca world tracks at all well with the routing-ca world. Is some of the concern here legacy space being pulled under 'RSA' by hook/crook? Could that be 'fixed' by IANA issuing certs to legacy address holders as that's likely the closest thing to the NIC that exists today and doesn't REALLY have the ability to enforce RSA-like restrictions as an RIR would? -Chris _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
