Hacker News Reader

> I think it would harm users relying on certain sites. This already happened with CNNIC and .cn

Care to elaborate? I don't really understand how it harms users.

In 2015, CNNIC have impersonated Google's domains (which while Google have a minimal presence in China is still a faux pas).

Also to clarify: restricting it to specific TLDs where the CA physically operated would amplify local laws, while restricting it to TLDs that are outside the CA's physical presence would basically mess up enforcement and would spur governments to curate a mandatory sanctioned list (heard of EU QWAC?) It's a lose-lose case either way.

I’m aware of the incident, but I don’t understand your reasoning. Had CNNIC been restricted to issue certificates only for .cn domains, the incident would have never been possible. That should be a supporting evidence for CA name constraints.

I don’t understand the “amplifying local law” part. How is restricting the power amplifying?

CNNIC was caught signing fake Google certs.

Reply on news.ycombinator.com