[cryptography] Updated Certificate Transparency site
wasabee18 at gmail.com
Thu Aug 1 13:57:19 EDT 2013
in CT, how do you tell if a newly-generated cert is legitimate or not?
Say, I am a state-sponsored attacker and can get a cert signed by my
national CA for barclays. How do you tell this cert is not legitimate? It
could have been barclays' IT admin who asked for a new cert.
Do companies need to liaise with CT to tell them which certs are valid? Do
they need to tell CT each time they change or get new certs?
Sorry if this is basic CT knowledge...
On Thu, Aug 1, 2013 at 12:06 PM, Ben Laurie <ben at links.org> wrote:
> Since there was some puzzlement over CT, I thought it might be of
> interest that we have revamped the site:
> Comments and questions welcome.
> cryptography mailing list
> cryptography at randombit.net
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the cryptography