4 ms·
Shame that these elemental security issues were present in the first case, and that StartCom went live with such an 'untested' and 'unaudited' product without d
by sigio 10y ago
Shame that these elemental security issues were present in the first case, and that StartCom went live with such an 'untested' and 'unaudited' product without doing a public-beta like Lets-Encrypt did (with non-trusted-by-default certificates).
- agwa 10y agoIt's also a shame they designed their own protocol instead of just using ACME[1], which is a standards-track IETF draft which has received significant security scrutiny. By ignoring ACME, they even managed to replicate my duplicate signature key selection vulnerability that was fixed in ACME nearly a year ago! [1] https://datatracker.ietf.org/wg/acme/charter/ https://datatracker.ietf.org/wg/acme/charter/
- schoen 10y agoDuring Let's Encrypt's beta, the certificates were already publicly trusted.
- sp332 10y agoThey were untrusted for about a month at least. September 14 - October 19 https://letsencrypt.org/blog/ https://letsencrypt.org/blog/