CA
A certificate authority (CA) is a trusted third-party entity responsible for issuing and managing digital certificates. It is the core component of the trust chain in public key infrastructure (PKI).
Core Facts
Timeline (last 90 days)
Consolidation of commercial CAs will continue, the general certificate market will become further infrastructure-ized, and enterprise identity services will become the main growth point for CA organizations.
If a CA wants its certificates to be trusted by browsers, it must pass third-party audits such as WebTrust and continuously meet the CA/B Forum baseline requirements.
When a CA exits the business, if the CRL/OCSP services go offline early, clients will be unable to confirm certificate status, and some strict-mode browsers or systems may report errors directly.
The root cause of such incidents is often not that cryptography has been broken, but rather lapses in the CA operator's access control, key management or supply chain security.
For organizations that rely on third-party CAs, vendor security assessments should include key management practices in their scope.
The 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
Rejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.
Historically, Go has repeatedly removed or rejected specific root certificates through new releases, for example after discovering improper issuance behavior by certain CAs.
A rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.
From the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
2 more timeline events
All Facts (13)
SSL/TLS certificates establish secure channels through asymmetric encryption technology and are issued by trusted CAs (Certificate Authorities).
75%UnverifiedIf a CA wants its certificates to be trusted by browsers, it must pass third-party audits such as WebTrust and continuously meet the CA/B Forum baseline requirements.
50%UnverifiedWhen a CA exits the business, if the CRL/OCSP services go offline early, clients will be unable to confirm certificate status, and some strict-mode browsers or systems may report errors directly.
50%UnverifiedThe root cause of such incidents is often not that cryptography has been broken, but rather lapses in the CA operator's access control, key management or supply chain security.
50%UnverifiedFor organizations that rely on third-party CAs, vendor security assessments should include key management practices in their scope.
50%UnverifiedThe 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
50%UnverifiedRejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.
50%UnverifiedA rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.
50%UnverifiedHistorically, Go has repeatedly removed or rejected specific root certificates through new releases, for example after discovering improper issuance behavior by certain CAs.
50%UnverifiedFrom the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
50%UnverifiedThe security of the CA trust system depends on its weakest CA — if any CA is compromised or has validation flaws, it may result in legitimate certificates being issued for domains not owned by the requester.
50%UnverifiedTLS certificates are issued by trusted Certificate Authorities (CAs) to prove the ownership and identity authenticity of a domain name.
50%UnverifiedConsolidation of commercial CAs will continue, the general certificate market will become further infrastructure-ized, and enterprise identity services will become the main growth point for CA organizations.
50%