every web browser in the world will be forced to trust the root certificates from all European Trust Service Providers
What I could never understand is why limiting the scope of root certificates is not a standard feature? Why cannot I set a whitelist of domains for the specific root certificate and expect the connection to fail when this root is used for anything else?
Not really. That's still something the owner of the domain has to do. What I'm talking about is a setting in the browser that lets me as a user decide what root certificates I want to trust and for what. Why can't I do that?
Comments
What I could never understand is why limiting the scope of root certificates is not a standard feature? Why cannot I set a whitelist of domains for the specific root certificate and expect the connection to fail when this root is used for anything else?
You can using a CAA DNS record.
Not really. That's still something the owner of the domain has to do. What I'm talking about is a setting in the browser that lets me as a user decide what root certificates I want to trust and for what. Why can't I do that?