If you look now, you get the best choice of caves to hide in #pqc #quantum

All browser root stores are NOT the same

Getting feisty again over at Bugzilla webpki.substack.com/p/entrus…

The origin story for the Common CA Database (CCADB) which is used to administer certification authorities in the webPKI, thanks Kathleen! groups.google.com/a/ccadb.or…

Practical RFC of test public keys for RSA, DLP (like Diffie Hellman), ECDLP (like ECDSA) 🤓 rfc-editor.org/authors/rfc95…

New RFC for Certification Authority Authorization (CAA) for S/MIME rfc-editor.org/rfc/rfc9495.h…

@digicert open sources its linter, automated compliance checker for digital certificates, including for new CA/Browser Forum #SMIME BR digicert.com/blog/digicert-r…

Nifty: Ukraine has eIDAS-style Trusted List 👍 eidas.ec.europa.eu/efda/tl-b…

Plenty of domains use Certificate Authority Authorization CAA to restrict #TLS issuance to a CA. This is the first CA implementation I see allowing sites to restrict to an account at the CA as described in section 3 of rfc6844 docs.digicert.com/manage-cer…

It's a trap!