Hacker News Reader

I'd like to know why Google, Mozilla and Microsoft did no due diligence on this company before approving their root CA. Why does it take being called out by an independent researcher before these basic questions get asked?

View on HN

Maybe they did, and it was fine at the time, and then things became messy?

I expect there’s also been a degree of grandfathering of the root certs from a time where there was a lot less scrutiny.

Reply on news.ycombinator.com