4 ms·

That it's nor revoked yet doesn't reflect well on COMODO at all, not that it's the first thing that doesn't...

• 0x0 11y ago
  Came here to say the same thing. Doesn't the CA forum baseline require a revocation if the private key is published? https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.pdf https://cabforum.org/wp-content/uploads/CAB-Forum-BR-1.3.0.p... on page 18: The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: (...) 3. The CA obtains evidence that the Subscriber’s Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise or no longer complies with the requirements of Appendix A;
  • yrro 11y ago
    Hm, how is that compatible with Startcom's policy of charging for revocation?
    • 0x0 11y ago
      Good question. Maybe you can skip the fee by posting your private key to pastebin and send them the link? :P Might not leave you with an account in good standing with them though ;)
      • TheLoneWolfling 11y ago
        That has been tried before: https://web.archive.org/web/20140412085458/https://revokame.tonylampada.com.br/ https://web.archive.org/web/20140412085458/https://revokame....
        • drdaeman 11y ago
          Hah. So sslip.io should went with Startcom instead of Comodo.
    • nailer 11y ago
      Mozilla should probably add 'charging for revocation' to their list of problematic practices (required to be included in Firefox). Not that revocating compromised certificates isn't already required, but just that some behavior by poor CAs needs to be explicitly pointed out: https://wiki.mozilla.org/CA:Problematic_Practices https://wiki.mozilla.org/CA:Problematic_Practices
      • brohee 11y ago
        What? Revoking expired certificate is not required, and would be a completely useless thing to do, bloating CRLs for no gain whatsoever.
        • nailer 11y ago
          Sorry, my bad. I wrote 'revoking expired certificates' rather than 'revoking compromised certificates'. Now fixed.
    • TheLoneWolfling 11y ago
      It isn't.
  • viraptor 11y ago
    I was actually looking at the comodo website to figure out if I can submit revokation on my own (we've got the key after all...). Gave up after looking at 20+ pages. Apart from a login site for email cert revocation, I can't find any reasonable contact. Comodo website is not that good apparently. Edit: in the document posted by brohee: (about authentication for certs revocation) "OR the Subscriber must be able to send an S/MIME email signed with the private key associated with the Certificate". That's doable :)
    • brohee 11y ago
      sslabuse@comodo.com it is 4.9.2 Who can Request Revocation A Subscriber or another appropriately authorized party can request revocation of a Certificate. An authorized party includes an RA, regardless of whether on behalf of the Subscriber may request revocation through their account. Other parties may report suspected Private Key Compromise, Certificate misuse, or other types of fraud, compromise, misuse, inappropriate conduct, or any other matter related to Certificates, in the first instance, by email to sslabuse@comodo.com.
  • brohee 11y ago
    COMODO policy is compliant, they just didn't act on it yet https://www.comodo.com/repository/Comodo_CA_CPS_4.1.4.pdf https://www.comodo.com/repository/Comodo_CA_CPS_4.1.4.pdf 4.9.1 Circumstances for Revocation Comodo may revoke a digital Certificate if any of the following occur: A personal identification number, Private Key or password has, or is likely to become known to someone not authorized to use it, or is being or is likely to be used in an unauthorized way
    • perlgeek 11y ago
      Well, if the buyer of the certificate authorizes everybody to use the private key, technically it's not a "use [...] in an unauthorized way".
      • ceejayoz 11y ago
        It may be unauthorized per Comodo's TOS.