Certificate Authority Gave Out Certs for GitHub to a GitHub Account Holder
The CA system is so broken. Even if you pick a trustworthy CA, you&#x27;re at the mercy of the weakest link (any random other CA elsewhere in the world).<p>I feel we would be better off if CA tasks were limited to the registrar responsible for any given domain. For non-EV certificates, this removes the need for fragile ownership checks. Also, a technical measure could probably be put in place on clients so other registrars&#x2F;CA can&#x27;t spring fake certificates on your domain, by cross-checking that the CA is also the actual registrar. This would stop the race-to-the-bottom for both registrars and CAs, since if you pick a highly trustworthy CA you could be more confident no other CA would be able to wrongly issue a certificate for your domain (edit: or that your own CA would betray you). If you want top notch security, you could pay a premium, but actually get value for your dollars by picking a &quot;more secure&quot; registrar-and-CA service - instead of today&#x27;s wildly varying prices for non-EV certificates, where expensive CAs bring zero value for their premium.