3 ms·
OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?
by hughw 10y ago
OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?
- Redoubts 10y agoSupposedly they were bought by WoSign http://letsphish.clonezone.link/part1 http://letsphish.clonezone.link/part1 I say supposedly because this is an archive of the original domain https://www.letsphish.org/ https://www.letsphish.org/ which now says > September 1, 2016: > I'm currently going under legal review of the site. > Content will not be available during this period.
- Manishearth 10y agoIIRC not in this case because WoSign had been accepted as a root, it just wasn't in all browsers yet. LetsEncrypt went through the same process -- it was accepted, but it takes time for root store updates to reach all consumers so in the meantime it was cross signed by some other ca. That ca has no responsibility here, since letsencrypt was itself accepted as a CA and was a peer (and is thus fully responsible for its own actions)