Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

"Purpose" refers to the type of certificate, e.g. SSL/TLS certificate, S/MIME certificate, code signing certificate.

Some roots in Mozilla's store are trusted for TLS only, some for S/MIME only, and some for both. The blog post is about applications which are using Mozilla's root store to verify certificates which are for a different purpose than the root is trusted for.

For example, NuGet uses Mozilla's root store to verify code signing certificates, which is obviously wrong because none of the roots in Mozilla's store are trusted for the purpose of code signing: https://github.com/NuGet/Announcements/issues/56



Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: