I wonder if browsers will tighten permissions and stop accepting sub CA certs from those CAs listed on their spreadsheet as not having any subs..
Landry Breuil <lan...@rhaalovely.net> wrote: >On Mon, Dec 31, 2012 at 01:41:27AM -0700, Landry Breuil wrote: >> CVSROOT: /cvs >> Module name: ports >> Changes by: lan...@cvs.openbsd.org 2012/12/31 01:41:27 >> >> Modified files: >> security/nss : Makefile distinfo >> >> Log message: >> Update to nss-3.14.1.with.ckbi.1.93, which explicitely distrusts >> "TURKTRUST Mis-issued Intermediate CA 1" & "TURKTRUST Mis-issued >> Intermediate CA 2". >> (added in #768547, removed in #825022) > >And for people interested in the details of that security issue : >http://lwn.net/Articles/531346/ >https://blog.mozilla.org/security/2013/01/03/revoking-trust-in-two-turktrust-certficates/ >http://googleonlinesecurity.blogspot.fr/2013/01/enhancing-digital-certificate-security.html >provide more info on it. Basically, a fraudulent cert for *.google.com >was issued by an intermediate CA mistakenly issued by TURKTRUST. > >oops.
