Chinese CA WoSign faces revocation after possibly issuing fake certificates
Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA.<p>Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, they have no incentive to cooperate; they can backdate certs and destroy their own customer list.<p>My theory is [1] this is one of the side benefits of Certificate Transparency - CT will give browser vendors a list of certs to grandfather in if they decide to shut down a CA against its will.<p>[1] <a href="https://www.mjt.me.uk/posts/certificate-transparency/" rel="nofollow">https://www.mjt.me.uk/posts/certificate-transparency/</a>