Specify which TLDs the root CAs are responsible for! [LWN.net]

Specify which TLDs the root CAs are responsible for!

Posted Feb 3, 2010 12:52 UTC (Wed) by paulj (subscriber, #341)
In reply to: Specify which TLDs the root CAs are responsible for! by cortana
Parent article: China Internet Network Information Center accepted as a Mozilla root CA

x.509 has this ability already. Subordinate CAs can be recognised by root CAs,
and the subordinate CAs can then sign certificates named below their name.

It's basically little used. My vague impression is that existing root CAs charge
*lots* of money to sign subordinate CA certs, and also other orgs want the
prestige of being a root CA.

Basically, while technical people love logical, hierarchical systems for
naming/responsibility delegate, politics, social dynamics and normal people
seem to abhor it. So these technical hierarchicalisation abilities tend to go to
waste.

SSL, DNS, etc.. They've all tended from hierarchalisation at inception towards
flat, unmanageable messes as deployment increases. (counter examples
would be really interesting, e.g. postal addresses have gotten flatter too
thanks to post codes).

(Log in to post comments)