Hacker News Reader

> and no TLS certificates chaining to these CAs ever showed up in CT

Why are browsers trusting CAs which issued zero certificates since their creation 1 year ago?

These are intermediate roots, signed by trusted root certs, so the trust from your OS or browser is implicit to the roots it trusts.

Yes, but there was no TLS cert issued that had these intermediate certs in its chain of trust at all anywhere. So why are they a CA if they don't issue any certs?

Their other intermediates have issued certs.

At this point, I think it'd be reasonable to start saying "why do we trust intermediate roots, period".

Reply on news.ycombinator.com