Subject: [Trans] FYI: Certificate Transparency catches Symantec

From: Paul Wouters <[email-masked]>
Date: Mon, 21 Sep 2015 21:54:52 -0400 (EDT)

In a first, Certificate Transparency catches Symantec forging EV cert for Google

https://www.eff.org/deeplinks/2015/09/symantec-issues-rogue-ev-certificate-googlecom

It is interesting in that it apparently was a certificate issued in a
test lab, but CT caused it to end up at google.

Paul

---

From: Matt Palmer <[email-masked]>
Date: Tue, 22 Sep 2015 13:17:46 +1000

> test lab, but CT caused it to end up at google.

For it to end up in a CT server, it would have to chain to a
publically-trusted root (unless some CAs have test roots they've put into
real CT servers, which is arguably also a dumb idea).  Why is a test lab
using publically-trusted roots *at all*?

Looks to me like CT did its job admirably, and its a credit to everyone
involved in making CT happen.

- Matt