Hacker News Reader

> Microsoft aren't taking more right now. So you have to wait for some unknown time in the future when/if they start doing that again.

Interesting, I hadn’t heard that, is there anywhere I can read more about it?

> You could purchase a root off an existing CA,

As well as a sub-CA, I remember in theory you can have two independent CAs with cross-signing… but do browsers actually support that?

View on HN

"Nothing public to point out to" is probably accurate but it is noted publicly here: https://learn.microsoft.com/en-us/security/trusted-root/new-...

Nothing public to point to, sorry.

Sub-CAs: Not really. Operational risk to the parent CA is huge, you'd be hard pressed to get any current public CA to sign an issuing CA to be operated externally. Cross-signing still works (though it is the stuff of nightmares in many cases) but again you have to have money and a CA willing to do it!

Entrust is/was doing it with ssl.com after they were detrusted.

No, SSLCorp are hosting and managing a CA with Entrust branding. Same as Sectigo are doing. Entrust aren't doing issuance, verification - they're straight reselling from white-labeled issuing CAs.

Reply on news.ycombinator.com