TLS certificate management on Android

> So Amazon can issue a million certs tomorrow across the entire namespace, they wouldn't want a delegation.
I should have been more clear - large companies need a lot of certificates for internal purposes and for user-facing services.

AWS already has one-click SSL for load-balancers.

> The "delegation" pipe dream is just that... Huge parts of the x509 certificate spec are written off as unsuitable for any purpose
The problem is not that parts of X509 are not accessible, but that it's a freaking mess. And TLS is a doubly freaking mess.

Writing a fully conformant TLS stack with all the options supported is pretty much impossible. We're still getting bugs discovered in the spec itself (all those downgrade attacks).

The correct course of action would be designing a completely new infrastructure, that can utilize advances like DNSSEC from the start. It's a pipe dream, but still....