2026-10-22 07:26 UTC
It’s actually possible:
In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but yout http client library probably doesn’t - and this is why these compromised keys are a problem).
Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate for the government spying something went really wrong at a CA and that CA would probably lose all the credibility and trust.
Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert.
Example: ctlogs.dev/search?q=Programming.dev
Replies (2)
-
@ExLisper@lemmy.curiana.net 2026-10-22 07:35
Yes, but if it’s not used for a website but VPN for example. If NSA got a private key from some compromised CA and did MITM on some VPN users, would anyone notice?
-
@kuberoot@discuss.tchncs.de 2026-10-22 07:51
I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I’m not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.