GripNews➤ 從證書頒發機構的權力遊戲看現代網路信任危機
✤ https://blog.brycekerley.net/2026/03/08/webpki-and-you.html
本文深入探討網路公鑰基礎設施（WebPKI）的運作機制與其背後的政治與社會意義。作者指出，WebPKI 不僅僅是數據中心的硬體架構，更是一個由多方博弈、受利益驅動的複雜管理體系。文章透過梳理 HTTPS 的演進史，詳細解析了從證書核發、域名驗證（DV）到組織驗證（OV/EV）的流程，並揭示了在這個必須「信任」的系統中，當證書核發機構（CA）出現管理紕漏時，整個網路生態將面臨多大的風險。
+ 這篇文章把 WebPKI 的技術複雜度與社會政治層面連結得很棒，特別是提到 CA 與瀏覽器廠商之間的利益關係，這通常是技術文件中被忽略的部分。
+ 對於剛入門網路安全的人來說，這是很好的科普。但坦白說，看到 WebPKI 這種結構，依然會對現代網路的信任根基感到有些脆弱。
#網路安全 #WebPKI #HTTPS #加密技術 #數位憑證
WebPKI and You
There’s been a push over the last twelve years to move web traffic off unencrypted HTTP to encrypted HTTPS, to protect the general public from dragnet surveillance, gaping assholes on public wifi>airpwn, backhauls over unencrypted satellites, that kinda thing. HTTPS relies on a public key infrastructure to make sure only authorized servers have keys for specific websites. [>oid]: an OID or “Object IDentifier” is intended [brs]: https://cabforum.org/working-groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS-BR-2.1.8.pdf [crtsh]: https://crt.sh/?q=blog.brycekerley.net [lol-diginotar]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates [iv-ocsp]: https://www.imperialviolet.org/2011/03/18/revocation.html [>mac-ocsp]: Jeff Johnson’s [>crlite]: these use cascading bloom filters which [>short-lived]: the CA/BF baseline requirements [trustico-chrome]: https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html [trustico-gone]: https://arstechnica.com/information-technology/2018/03/trustico-website-goes-dark-after-someone-drops-critical-flaw-on-twitter/ [trustico-compromise]: https://groups.google.com/g/mozilla.dev.security.policy/c/wxX4Yv0E3Mk/m/o1cdfx2nAQAJ [>enclaves]: Amazon Web Services (AWS) and [>history]: i mean, i remember from when it happened [>parasite]: You may have realized that I don’t think [van-halen]: https://snackstack.net/2023/07/03/in-search-of-van-halens-brown-mms/ [>osi]: I’m not going to hit you with a [>responsibility]: in every part of your life! [>bloom]: [>later]: At time of publishing, it’s March 8, 2026 [hsts]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security [>hsts]: This is generally a hardcoded value, [>cattle]: “cattle” is when there’s [ari]: https://letsencrypt.org/2025/09/16/ari-rfc [>caddy-ari]: I checked Caddy, the front-end server [>left]: there may be value in trying to renew [audits]: https://cabforum.org/about/information/auditors-and-assessors/audit-criteria/