|
|
|
|
|
|
by rhplus
564 days ago
|
|
|
> What am I missing? The chain of trust for all the certificates in your example is established by trusting the rogue CA root certificate. The CA (or a bad actor who misled the CA through real-world fraud) could be the “owner” of the key pair you’re trusting for the second signature. |
|
|