Certificate Authority - Revision history

Tom: /* Problems */

2024-02-20T02:20:39Z

‎Problems

Tom: /* Context */

2024-02-20T02:19:42Z

‎Context

Tom: /* Problems */

2024-02-20T02:11:10Z

‎Problems

Tom: /* Problems */

2024-02-20T02:09:40Z

‎Problems

Tom: /* Problems */

2024-02-20T02:08:54Z

‎Problems

Tom: /* Problems */

2024-02-20T02:07:49Z

‎Problems

Tom: /* Problems */

2024-02-20T02:06:43Z

‎Problems

Tom: /* Problems */

2024-02-20T02:01:13Z

‎Problems

Tom: /* Context */

2024-02-20T02:00:31Z

‎Context

Tom: /* Context */

2024-02-20T01:55:24Z

‎Context

@@ Line 9: / Line 9: @@
 ==Problems==
-# Enhanced Security Verification - When you connect to a website, browsers like **Chrome** not only verify that a recognized Certificate Authority (CA) issued the certificate but also perform additional checks on the connection's security properties. - One such check involves validating data from [[Certificate Transparency]] logs. These logs help detect any mis-issuance of certificates after they have been issued.<ref> How the Chrome Root Program Keeps Users Safe - Security Blog. https://security.googleblog.com/2023/05/how-chrome-root-program-keeps-users-safe.html.</ref>
+# Enhanced Security Verification - When you connect to a website, browsers like **Chrome** not only verify that a recognized Certificate Authority (CA) issued the certificate but also perform additional checks on the connection's security properties. - One such check involves validating data from [[Certificate Transparency]] logs. These logs help detect any mis-issuance of certificates after they are in production.<ref> How the Chrome Root Program Keeps Users Safe - Security Blog. https://security.googleblog.com/2023/05/how-chrome-root-program-keeps-users-safe.html.</ref>
 # Post-Issuance Validation  - CT works within the existing CA infrastructure to provide **post-issuance validation** of an entity's authorization for SSL certificate issuance.<ref> Why and How You Should be Using an Internal Certificate Authority. https://isc.sans.edu/diary/Why+and+How+You+Should+be+Using+an+Internal+Certificate+Authority/27314.</ref> - By monitoring these logs, domain owners can identify any unauthorized or suspicious certificates associated with their domains.
 # Privacy Concerns - Public CAs maintain **[[Certificate Transparency]] logs**, which are publicly accessible and searchable.  - Some organizations prefer to use their **internal certificate authorities** to avoid having their internal host-names appear in these public logs.

@@ Line 5: / Line 5: @@
 * Typically, certificates are issued in compliance with CCITT X509 standards in support of a [[Public Key Infrastructure]].
 * Efforts started in 2024 are focused on finding other solutions which might mean CCITT X.509 type certification in JSON structure.
-* Other effort to create various types of [[Trust Registry]] are starting to look a lot like a [[Certificate Authority]].
+* Other effort to create various types of a [[Trust Registry]] are starting to look a lot like a [[Certificate Authority]].
 ==Problems==

@@ Line 11: / Line 11: @@
 # Post-Issuance Validation  - CT works within the existing CA infrastructure to provide **post-issuance validation** of an entity's authorization for SSL certificate issuance.<ref> Why and How You Should be Using an Internal Certificate Authority. https://isc.sans.edu/diary/Why+and+How+You+Should+be+Using+an+Internal+Certificate+Authority/27314.</ref> - By monitoring these logs, domain owners can identify any unauthorized or suspicious certificates associated with their domains.
 # Privacy Concerns - Public CAs maintain **[[Certificate Transparency]] logs**, which are publicly accessible and searchable.  - Some organizations prefer to use their **internal certificate authorities** to avoid having their internal host-names appear in these public logs.
-# Future Adoption - While most CAs currently support CT primarily for **Extended Validation (EV) certificates**, there is a possibility of extending it to all SSL certificates in the future.<ref> The HTTPS-Only Standard - Certificates - CIO.GOV. https://https.cio.gov/certificates/.</ref>
+# Future Adoption - While most CAs currently support CT primarily for Extended Validation [[EV Cert]]s, there is a possibility of extending it to all SSL certificates in the future.<ref> The HTTPS-Only Standard - Certificates - CIO.GOV. https://https.cio.gov/certificates/.</ref>
 In summary, the move toward **Certificate Transparency** aims to bolster security, increase transparency, and ensure the integrity of SSL certificates across the web.<ref> Moving Forward with Certificate Transparency - Entrust Blog. https://www.entrust.com/blog/2014/12/moving-forward-with-certificate-transparency/.</ref>

@@ Line 10: / Line 10: @@
 # Enhanced Security Verification - When you connect to a website, browsers like **Chrome** not only verify that a recognized Certificate Authority (CA) issued the certificate but also perform additional checks on the connection's security properties. - One such check involves validating data from [[Certificate Transparency]] logs. These logs help detect any mis-issuance of certificates after they have been issued.<ref> How the Chrome Root Program Keeps Users Safe - Security Blog. https://security.googleblog.com/2023/05/how-chrome-root-program-keeps-users-safe.html.</ref>
 # Post-Issuance Validation  - CT works within the existing CA infrastructure to provide **post-issuance validation** of an entity's authorization for SSL certificate issuance.<ref> Why and How You Should be Using an Internal Certificate Authority. https://isc.sans.edu/diary/Why+and+How+You+Should+be+Using+an+Internal+Certificate+Authority/27314.</ref> - By monitoring these logs, domain owners can identify any unauthorized or suspicious certificates associated with their domains.
-# Privacy Concerns - Public CAs maintain **[[Certificate Transparency]] logs**, which are publicly accessible and searchable.  - Some organizations prefer to use their **internal certificate authorities** to avoid having their internal host-names appear in these public logs.<ref> Moving Forward with Certificate Transparency - Entrust Blog. https://www.entrust.com/blog/2014/12/moving-forward-with-certificate-transparency/.</ref>
+# Privacy Concerns - Public CAs maintain **[[Certificate Transparency]] logs**, which are publicly accessible and searchable.  - Some organizations prefer to use their **internal certificate authorities** to avoid having their internal host-names appear in these public logs.
 # Future Adoption - While most CAs currently support CT primarily for **Extended Validation (EV) certificates**, there is a possibility of extending it to all SSL certificates in the future.<ref> The HTTPS-Only Standard - Certificates - CIO.GOV. https://https.cio.gov/certificates/.</ref>

@@ Line 13: / Line 13: @@
 # Future Adoption - While most CAs currently support CT primarily for **Extended Validation (EV) certificates**, there is a possibility of extending it to all SSL certificates in the future.<ref> The HTTPS-Only Standard - Certificates - CIO.GOV. https://https.cio.gov/certificates/.</ref>
-In summary, the move toward **Certificate Transparency** aims to bolster security, increase transparency, and ensure the integrity of SSL certificates across the web.
+In summary, the move toward **Certificate Transparency** aims to bolster security, increase transparency, and ensure the integrity of SSL certificates across the web.<ref> Moving Forward with Certificate Transparency - Entrust Blog. https://www.entrust.com/blog/2014/12/moving-forward-with-certificate-transparency/.</ref>
 ==References==
 [[Category: Trust]]

← Older revision		Revision as of 02:07, 20 February 2024
Line 16:		Line 16:


−	~~<ref> How does Certificate Transparency Work? \| DigiCert FAQ. https://www.digicert.com/faq/certificate-transparency/how-does-certificate-transparency-work.</ref>~~	+

	<ref> Moving Forward with Certificate Transparency - Entrust Blog. https://www.entrust.com/blog/2014/12/moving-forward-with-certificate-transparency/.</ref>		<ref> Moving Forward with Certificate Transparency - Entrust Blog. https://www.entrust.com/blog/2014/12/moving-forward-with-certificate-transparency/.</ref>

@@ Line 8: / Line 8: @@
 ==Problems==
-# Enhanced Security Verification - When you connect to a website, browsers like **Chrome** not only verify that a recognized Certificate Authority (CA) issued the certificate but also perform additional checks on the connection's security properties.
+# Enhanced Security Verification - When you connect to a website, browsers like **Chrome** not only verify that a recognized Certificate Authority (CA) issued the certificate but also perform additional checks on the connection's security properties. - One such check involves validating data from **Certificate Transparency logs**¹. These logs help detect any mis-issuance of certificates after they have been issued.
-   - One such check involves validating data from **Certificate Transparency logs**¹. These logs help detect any mis-issuance of certificates after they have been issued.
+# Post-Issuance Validation  - CT works within the existing CA infrastructure to provide **post-issuance validation** of an entity's authorization for SSL certificate issuance³. - By monitoring these logs, domain owners can identify any unauthorized or suspicious certificates associated with their domains.
 # Privacy Concerns - Public CAs maintain **certificate transparency logs**, which are publicly accessible and searchable.  - Some organizations prefer to use their **internal certificate authorities** to avoid having their internal hostnames appear in these public logs⁴.
 # Future Adoption**: - While most CAs currently support CT primarily for **Extended Validation (EV) certificates**, there is a possibility of extending it to all SSL certificates in the future⁵.