Hacker News Reader

When is Sectigo, the root CA that cross-signed the vulnerable intermediate CAs, going to take responsibility for fucking up too? Why should we keep trusting them?

View on HN

eMudhra was a root CA. Their roots and intermediates were cross-signed by Sectigo since it was a new(-ish) root CA (a comment on Reddit characterized eMudhra as a Sectigo reseller, but I can't find verification of that), but I don't know to what extent that was done as a result of Sectigo's own evaluation vs. some internal process of a larger entity like the CA/Browser Forum. (Without cross-signing, it's difficult for a new CA to operate, so I imagine there must be some process by which a particular existing-CA cat is belled to be the cross-signer.)

I was referring to Sectigo. Edited to make it clearer.

I'm not sure (but would love to know) if Sectigo actively chose to sign eMudhra's certs (though if eMudhra is a reseller of theirs, it would make sense to do so), or if maybe it was just "their turn in the barrel" to be the designated cross-signer of a new CA's certs so the new CA could be a useful entity.

Why would a CA "have" to sign anything ?

By signing eMudhra's CA, sectigo put their own responsability on the table

And by doing so without sufficient checking of the signee's quality, they prove to the world that they shall not be trusted

Reply on news.ycombinator.com