Hacker News Reader

While adding a new CA to trusted set requires some kind of rigor, there's a quite large selection of CAs that were just "always there".

Since many browser vendors are reluctant to remove CAs (because it breaks lots of websites for users), they don't have too much leverage enforcing security practices.

Here's the audit: https://bugzilla.mozilla.org/show_bug.cgi?id=1628720#c14

The requirements they are supposed to check against: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... - section 5 addresses security, referencing "The CA/Browser Forum’s Network and Certificate System Security Requirements" - https://cabforum.org/network-security-requirements/, which at least in the version 1.3 that I saw required pentests and security scans.

I'd imagine CA/B forum adopting new rules to avoid situations like this. The very least just a requirement to publish security contact information.

And who is auditing them ? CIA ? Goldman Sachs ? KGB ? EFF ?