Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Presumably they are, but the entire point of an EV certificate is that the company's information is supposed to be vetted and verified. If a single human error can cause an invalid certificate to be issued, it's not just a problem with that one certificate. It's potentially a sign of systemic issues that call into question the trustworthiness of all other certificates issued by that CA.

A signed certificate that contains invalid or incorrect data is considered to have been misissued according to the CA/Browser Forum's Baseline Requirements [1]. Misissuance not only obligates the CA to quickly revoke the certificate upon discovery, but also frequently leads to discussions in places like Mozilla's dev-security-policy mailing list. [2]

If you follow some of those discussions, you'll quickly see that browser vendors hold the CAs to fairly high standards. Blaming a misissuance on a "data entry error" is generally not considered sufficient or acceptable; they're expected to be able to explain why the errors were not caught by technical controls or verification processes, and how those defenses can be improved to prevent the same errors from recurring.

[1]: https://cabforum.org/baseline-requirements-documents/

[2]: https://groups.google.com/forum/#!forum/mozilla.dev.security...



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: