Chinese root CA issues rogue/fake certificates

Thu Sep 1 03:06:03 UTC 2016

In message <A75AD418-262A-4F12-A7FA-3C8D3861D1DA at orthanc.ca>, Lyndon Nerenberg 
writes:
> > On Aug 31, 2016, at 6:36 PM, Matt Palmer <mpalmer at hezmatt.org> wrote:
> >
> > Thanks, Netscape.  Great ecosystem you built.
>
> Nobody at that time had a clue how this environment was going to scale,
> let alone what the wide-ranging security issues would be.
>
> And where were you back then, not saving us from our erroneous path ...

Well lots of people have been pointing out the risks for years.

We are no where at "to big to fail" here.

We also have TLSA which can be used to prevent spoofed CERTs being
successful.  If you have a CERT you should be publishing a TLSA
records and have it DNSSEC signed.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org