CA
A certificate authority (CA) is a trusted third-party entity responsible for issuing and managing digital certificates. It is the core component of the trust chain in public key infrastructure (PKI).
Core Facts
Timeline (last 90 days)
The 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
A rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.
Historically, Go has repeatedly removed or rejected specific root certificates through new releases, for example after discovering improper issuance behavior by certain CAs.
Rejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.
From the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
The security of the CA trust system depends on its weakest CA — if any CA is compromised or has validation flaws, it may result in legitimate certificates being issued for domains not owned by the requester.
TLS certificates are issued by trusted Certificate Authorities (CAs) to prove the ownership and identity authenticity of a domain name.
All Facts (8)
SSL/TLS certificates establish secure channels through asymmetric encryption technology and are issued by trusted CAs (Certificate Authorities).
75%UnverifiedThe 'lock' in the browser address bar only means that the connection was signed by some CA, and does not mean that the other party's identity is absolutely trustworthy.
50%UnverifiedA rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.
50%UnverifiedHistorically, Go has repeatedly removed or rejected specific root certificates through new releases, for example after discovering improper issuance behavior by certain CAs.
50%UnverifiedRejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.
50%UnverifiedFrom the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
50%UnverifiedThe security of the CA trust system depends on its weakest CA — if any CA is compromised or has validation flaws, it may result in legitimate certificates being issued for domains not owned by the requester.
50%UnverifiedTLS certificates are issued by trusted Certificate Authorities (CAs) to prove the ownership and identity authenticity of a domain name.
50%