you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 6 days ago (2 children)

Interesting question! Google spit this out and it makes sense:

The primary reason these specific keys/issuers were created was to solve data sovereignty and data residency requirements for customers in those regions.

Many European and US corporate clients operate under strict legal frameworks (like GDPR in Europe or various federal compliance standards in the US) that legally dictate where cryptographic infrastructure can live, where data can be decrypted, and who can possess the root or intermediate private keys.

Generating separate regional keys is a compliance mechanism to guarantee that a customer's data or handshake traffic stays within their jurisdiction.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 5 days ago (1 child)

    Google is wrong. There is no security benefit to using an SSL certificate signer in your jurisdiction because a hacked or malicious certificate authority in another jurisdiction can man-in-the-middle you or your customers just as effectively.

    Certificate authorities do not decrypt data or even transfer it on behalf of customers.

  • source
  • parent
  • hideshow 1 child comment