[149850] in North American Network Operators' Group
Re: SSL Certificates
daemon@ATHENA.MIT.EDU (John Levine)
Thu Feb 16 11:30:27 2012
Date: 16 Feb 2012 16:29:03 -0000
From: "John Levine" <johnl@iecc.com>
To: nanog@nanog.org
In-Reply-To: <20120216162108.GA11808@ussenterprise.ufp.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
In article <20120216162108.GA11808@ussenterprise.ufp.org> you write:
>-=-=-=-=-=-
>
>In a message written on Thu, Feb 16, 2012 at 12:57:25AM -0600, Jimmy Hess wrote:
>> There is a risk that any CA issued SSL certificate signed by _any_ CA
>> may be worthless some time in the future, if the CA chosen is later
>> found to have issued sufficient quantities fraudulent certificates,
>> and sufficiently failed in their duties.
>
>One thing I'm not clear about is, are there any protocol or
>implementation limitations that require only one CA?
I've had the same cert signed by multiple CAs, although rarely at the
same time. Never tried to present both versions in the same session,
though.
R's,
John
