18 ms·

WoSign and StartCom: Mozilla’s proposed conclusion

608 points by aestetix 10y ago

hart_russell 10y ago
A 1 year suspension and continued trust of previously signed certificates? Sounds very generous to me.
- geofft 10y ago
  It's generous to the customers who currently have existing, valid WoSign or StartCom certificates. It's not very generous to WoSign or StartCom as continuing profitable businesses, because if I were paying either of these companies for certificates, I'd be looking for someone else to pay when it comes time to renew. This is exactly what you want.
- throwawayReply 10y ago
  With a "play by the rules or you're out" attached. It's more lenient than some might want, but it avoids the decision being controversial and perhaps lessens the chance that it is seriously challenged.
- TorKlingberg 10y ago
  It's not a 1 year suspension. It's a 1 year complete ban, then they may apply again from scratch, with extra requirements.
- tptacek 10y ago
  How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor (raises hand! pick me!) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear. StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue. You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.
  - bcg1 10y ago
    Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.
    - tptacek 10y ago
      It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.
      - jvehent 10y ago
        Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA. That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.
      - xnyhps 10y ago
        Or buy yet another CA and continue under their name?
      - x0x0 10y ago
        There should be a 1-year plus ban on principals as well.
  - bandrami 10y ago
    Yeah but the existing certs are still out there. While it's great that a company is being punished, this completely ignores the fact that we have no idea what they've signed, and short of laboriously checking the trust path of every single certificate you encounter there's no way to know if the cert you're looking at at any given moment came from them or not. And worse yet, the bigger problem is there's not a practical way to actually yank all of the certificates they signed that will work for arbitrary clients who don't know anything about this process to begin with and just look for a lock in the address bar, if that.
- gregmac 10y ago
  With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [..] Our proposal is that we determine “newly issued” by examining the notBefore date [...] therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
- jerf 10y ago
  To the other observations, I'd also observe that in a world of corporate entities, there isn't a meaningful way to permanently eliminate a CA. Bad actors can always dissolve the old entity, form a new one with the same policies and any of the same people you'd like, and do the same thing. Banning the existing corporation for a year is about all you can do; the more time that goes by the fuzzier it becomes as to what exactly that "entity" is. By far the more important element here is not that the specific corporate entity gets nuked, but that it be demonstrated to all and sundry that the CA standards have teeth. That is what will keep the bad actors from "just" doing anything to get around the problem, not psychologically-appealing vengeance.
- oxguy3 10y ago
  Given WoSign's history of backdating SHA-1 certificates in violation of Mozilla's rules, I wouldn't be too surprised if they reuse that practice to get around the 1 year ban, at which point Mozilla will have to consider permanently distrusting them.
  - nandhp 10y ago
    They've already considered it and are including this in their proposal: > WoSign/StartCom could back-date certificates to get around this restriction. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
    - Paul-ish 10y ago
      Would they do this out of spite? StartCom is essentially done for and has little to lose, so out of bitterness they could try to turn their customers against the browser vendors.
geofft 10y ago
This is a very detailed investigation - the parts that appear to be new are the specific serial number patterns, the times/dates of manual issuance, and the case of the Tyro SHA-1 cert. It's a little unfortunate that Mozilla's option here is to rely on WoSign and StartCom continuing to be honest about notBefore, or really, on Google detecting further abuse of notBefore via Certificate Transparency. Mozilla should really be participating in CT themselves so they have more options here. Is there anything the community can do to help (e.g., run more log servers)?
- xnyhps 10y ago
  > Google detecting further abuse of notBefore via Certificate Transparency You don't need to rely on Google. All certs issued by WoSign since January 1st, 2015 should be on WoSign's own Certificate Transparency log from which you can download them. StartCom is logging all new certs too, but I don't know for sure if they pushed all older ones too. If you ever encounter a cert that isn't on the list, that's definitive proof that they are backdating again. The list of certificates is too large for Mozilla to include a list of hashes in Firefox, but it might be a nice opportunity for a Firefox add-on.
  - dspillett 10y ago
    > You don't need to rely on Google ... should be on WoSign's own Certificate Transparency log which you can download Given that the behaviours being documented include falsifying data (backdating certificates to get around SHA1 retirement), I would prefer to at least use information from Google (or another third party) for the purpose of verification, rather than just relying on information sourced from WoSign/StartCom.
    - xnyhps 10y ago
      They can't backdate their Certificate Transparency log without leaving cryptographic evidence behind. That's how CT is designed to work. Of course, simply being in the log doesn't imply the cert was issued correctly, but the logs have been posted for a couple of months now and have received a lot of scrutiny during Mozilla's investigation. But the same is true for Google's log, presence in that log is also no guarantee that it was issued correctly.
crazypyro 10y ago
Completely and utterly fail your job, lie about it and use deceiving tactics? And all they are getting is a 1 year suspension and none of the certificates are becoming untrusted. The auditors got a bigger punishment by being banned completely from Mozilla's trusted auditors. Should just revoke them completely. Such incompetence and/or malice should not be allowed on such a crucial piece of infrastructure.
- geofft 10y ago
  Revoking them completely would be a pain for end users of StartCom and WoSign certificates, who had no way to know that their CA was incompetent and/or malicious. But this is a great way to choke out their business by the end of a year, since they can't sell any new products. Of course, it might be nice to actually revoke them so that in the future, "will my CA be revoked" is a realistic thing to think about when choosing a certificate seller. But revocation hurts other people (website owners and visitors) more than the CA, and it doesn't seem totally obvious that it's worth it.
  - no_protocol 10y ago
    Is there a compiled listing of all CA audits (good and bad) and "offenses" so a prospective customer might be able to choose a CA based on past performance rather than marketing materials?
  - wyager 10y ago
    Who cares if it's a pain? User security is vastly more important than saving companies from the mild inconvenience of changing certs.
    - tptacek 10y ago
      The fact that they're honoring previous certificates is a good thing. It's a demonstration from Mozilla and Google that CAs with large customer bases have very little leverage in disputes like this: Mozilla will respond with the corrective measure that causes maximum pain for the CA business and minimal pain for the CA's previous customers.
no_protocol 10y ago
A clear and detailed report. The conclusion seems both transparent and fair. It would be very difficult for many customers of StartCom/WoSign if they were immediately revoked. Hopefully this news spreads far enough that the reputation of StartCom/WoSign will generally include this information. I am saving this as a reference in the event I ever need to write a technical report. This style is so much easier to read than a typical "official" report from police, the FBI, or similar organizations. I don't have any StartCom or WoSign certificates right now, but I did in the past. It was nice to be able to get a certificate that browsers accepted, without needing to pay for it. I'm glad the landscape has changed.
- TorKlingberg 10y ago
  Yes, we are very fortunate to have Let's Encrypt now.
  - justinclift 10y ago
    One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom. We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar). At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's an unknown. o_O
    - aroch 10y ago
      NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit. ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).
    - deleted 10y ago
      [deleted]
    - edwinyzh 10y ago
nandhp 10y ago
I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action against WoSign?
- popey456963 10y ago
  Considering I believe one of the writers of this was from Google, I guess we can assume they'll likely follow? With both Chrome and Firefox no longer allowing certificates from them we can expect customers to no longer buy from them which will result in no more certificates even if Apple/Microsoft don't follow.
  - JonathonW 10y ago
    Does Chrome maintain its own trusted certificate list on any platform? IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.
    - pquerna 10y ago
      Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code: CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets https://dev.chromium.org/Home/chromium-security/crlsets HSTS Preloading: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ more: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
    - pkhagah 10y ago
      Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
koolba 10y ago
I like this part at the end: > In addition, Mozilla will: > add all of the Macau certificates to OneCRL immediately; > and no longer accept audits carried out by Ernst & Young (Hong Kong). If you don't hold the auditors responsible, this will happen again. If you do hold the auditors responsible, you might prevent some of this.
tux3 10y ago
>We also hope the public can see that when there are allegations of CA wrongdoing, Mozilla is committed to a fair, transparent and thorough investigation of the facts of each case. I'm very happy to see the way Mozilla handled this incident, both with the process and the conclusion. I have a moderate trust in the CA ecosystem as a whole, but I'm glad to see that overwhelming incompetence, if not outright maliciousness, does have consequences even to big CAs. At first though the proposed one year timeout can seem a little short given the impressive list of reported issues, but the conditions given for re-acceptance are strict enough that passing could only indicate a radical change in methodology, at which point it would only make good sense to consider a re-inclusion. In fact if every CA could take a full code security audit and provide complete certificate transparency in the manner proposed, I think we would have reason to feel marginally safer on the Internet.
- mtgx 10y ago
  My hope would be that since this method of punishing seems to be liked by most and even feels "generous" to some, the browser vendors would more aggressively start handing out "1 year suspensions" for more and more CAs that are caught doing anything even remotely like this. Then after a year or two, and after the CAs have learned that they need to take this stuff seriously, and yet some still get caught doing it, the browser vendors should increase the level of punishment, because those getting caught then wouldn't have much of an excuse anymore.
  - tptacek 10y ago
    The people saying this is "generous" are making largely irrational arguments. What Mozilla is proposing is the worst case for incumbent CAs.
    - tajen 10y ago
      > worst case Can you develop please? To me it seems that the worst case would be an immediate and permanent revocation of their certs because of fraud. I find Mozilla/Google very lenient in this affair, and that's probably because I don't understand what's the problem with revoking a CA with short notice. Ok it's annoying for customers, but they just have to subscribe to a new CA and install the new cert. It's annoying but it's a security emergency. If your bank was physically guarded by a security company who has been found to replace agents with puppets in 62 Macau banks, wouldn't the head of security interrupt their week-end to guard the bank and contract a new company? If CA revocation takes customers by surprise today, it's time to start revoking certs more regularly. Heck, if you don't answer to a request from your domain provider within 15 days, your domain can even be revoked. CAs are more important than that.
guelo 10y ago
If the CA market were efficient this would lead to bankruptcy of this company since there's no reason to chose them over the many competitors and many reasons to distrust them. Though of course the market is not efficient. I keep wondering when the Communist Party of China is going to make its heavy handed presence felt in the CA world.
- gcp 10y ago
  The browsers will distrust the CA. Which will, in all likelyhood, lead to their bankruptcy.
  - voltagex_ 10y ago
    Will they? Still gotta wait for Google, Microsoft and Apple. Is there any mechanism to push certificate updates to Android devices in the wild? Otherwise there's going to be a lot of devices that trust WoSign and StartCom, no matter what.
    - johncolanduoni 10y ago
      Chrome doesn't have their own certificate store, instead they use the platform's certificate store with some logic layered on top (e.g. requiring new Symantec certificates to be in the certificate transparency logs). So an update to the Chrome app on Android could implement Mozilla's plan, or something even more extreme.
    - vertex-four 10y ago
      In practice, nobody is going to buy a cert for general web use which doesn't work for Firefox. They could scale back drastically and focus on internal certs and certs for other uses, but that might not be enough to keep them afloat, especially with the reputation damage from this.
- lolc 10y ago
  Even after this disclosures, a fully informed, rational agent would still choose WoSign if their price and service were the best. This is because WoSign's behavior does not specifically endanger their customers. The SSL ecosystem relies on the trustworthiness of the certificate authorities. If one of them is compromised, the whole system is compromised, not just their customers. This cannot be solved by markets. Instead, it's heavily regulated.
tptacek 10y ago
Mozilla and Chrome are killing StartCom. This is huge, isn't it? StartCom is one of the more popular CAs. Later: Additional fun fact: there's a decent-sized subthread on the mailing list in which it's strongly suggested that WoSign is itself quietly owned by Qihoo360, a much larger company --- somewhat like the Symantec of China. More specifically: https://twitter.com/pzb/status/780456712562024448 https://twitter.com/pzb/status/780456712562024448
- blibble 10y ago
  after their heartbleed extortions they really deserve nothing less (and yes, I was a paying customer)
  - dspillett 10y ago
    While their current/recent behaviours that are being discussed are deplorable, I don't think the heartbleed thing is as morally corrupt as many people affected make out. Their rules always clearly stated the cost of replacement certificates and that this would only be waived if the replacement was needed due to their fault. As heartbleed was not a problem they caused they were well within their agreements with the customers to charge for revoking and resigning certificates. They missed a chance at earning "good faith points" but they presumably didn't value that over the income from resigned certificates. They are a commercial body afterall. Lets not dilute the discussion of cases where they appear to have been deliberately fraudulent by mixing in a past occurrence of them simply being uncaring.
    - joepie91_ 10y ago
      Oh come on, I get really tired of this "well, that's what the agreement said". Revocation is a critical part of a well-functioning CA system, and charging for revocations of free certificates actively puts that at risk, because it disincentivizes people from revoking potentially-compromised certificates - that is why it's morally corrupt. > They are a commercial body afterall. That's their problem, and putting the CA system at risk because "well, we have to make money somehow" is not even remotely acceptable.
joseignaciorc 10y ago
Just curiosity: since this report is a Google Doc, how can one know that it has been really written by Mozilla? Shouldn't it be under the mozilla.org domain?
- tptacek 10y ago
  It was written by multiple authors. Ryan Sleevi is at Google.
- gcp 10y ago
  The link was posted via mozilla.dev.security.policy
- deleted 10y ago
  [deleted]
- bratch 10y ago
  Being hosted where it is is particularly annoying because you can't view it unless you accept cookies from google.com. A JavaScript redirect takes you straight to https://support.google.com/accounts/answer/32050 https://support.google.com/accounts/answer/32050.
- Ajedi32 10y ago
  Well, here's the link to the document from the Mozilla Security mailing list: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/NAH6NVf3JPI https://groups.google.com/forum/#!topic/mozilla.dev.security... > Because this document is extensive and contains embedded images, links and formatting, I have published it on Google Docs instead of as an email message here: https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/edit https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBG...
sandGorgon 10y ago
why is this google docs ? why is this not atleast a markdown file in github ?
- popey456963 10y ago
  From tptacek: "It was written by multiple authors. Ryan Sleevi is at Google." I would assume the method it was written in is of little consequence to many, just that Google Docs offer far better convenience when working in teams.
- Sanddancer 10y ago
  This is a working draft of a findings document that's being actively edited. Google Docs allows for realtime cooperative collaboration, with nice features like chat and annotation of documents. There are a few other collaborative editing systems out there, but they tend to have more hitches than google docs'
gregmac 10y ago
I think this is very well handled on the part of Mozilla, especially with respect to existing customers. What's missing, which admittedly is not Mozilla's job, is to inform any existing customers that will have to renew during the time WoSign and StartCom are suspended. If they just get an invoice and pay it or are set-up with auto-renew, they'll unknowingly get certificates that aren't valid for the remainder of the suspension (or indefinitely, if WoSign/StartCom if violates Mozilla's requirements).
tarancato 10y ago
So I don't like Let's Encrypt, if Mozilla "kills" WoSign/StartCom, what are my options if I want a cert for free?
- gcp 10y ago
  Any other CA?
- chias 10y ago
  If you write off Let's Encrypt, I think your options will be limited to "pay for a certificate".
- oxguy3 10y ago
  What exactly don't you like about Let's Encrypt? Besides Let's Encrypt, your other option is paying for a cert from GoDaddy or something. My two cents: don't give business to Comodo, given their horrible track record of sleaziness (https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies).
  - tarancato 10y ago
    I don't like the EFF, but I guess I will have to use Let's Encrypt if there's no other option.
    - rudolf0 10y ago
      If I might ask, why don't you like them?
      - tarancato 10y ago
        They are a political organisation and their ideas conflict with mine. I don't keep a strong boycott on them, but I don't want to support their products, that's all.
        10y ago
pquerna 10y ago
While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting: > no longer accept audits carried out by Ernst & Young (Hong Kong). To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.
- chillydawg 10y ago
  Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.
  - pquerna 10y ago
    Completely Agree! When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.
- tomjen3 10y ago
  Isn't that only E&Y Hong Kong, though? Really at this point I don't know why anybody in China, or any country known for its corruption, should be accepted as auditors.
  - jrockway 10y ago
    You're painting 1 billion people with a rather broad brush.
    - rocqua 10y ago
      He's only painting the authorities of those people with a broad brush. If something was confirmed from a chinese authority (private or public) would you trust that more, less, or the same due to the 'chinese' specifier?
shawkinaw 10y ago
Goddammit. I really liked StartCom for free S/MIME certificates and TLS certs that don't expire after a month. So people, is there a comparable free product out there (don't say LetsEncrypt, they don't do S/MIME unless I'm mistaken)?
- tptacek 10y ago
  Why are you using S/MIME? You can still get free S/MIME certs from Comodo.
  - shawkinaw 10y ago
    Mostly for fun.
  - carsonreinke 10y ago
    What is wrong with S/MIME?
    - TD-Linux 10y ago
      It has less users than PGP/MIME, which is an impressive feat.
      - tgsovlerkhgsel 10y ago
        Since many major clients support it out of the box, I'd say that at least for verification purposes, it has more users than PGP/MIME.
  - TeMPOraL 10y ago
    Wasn't Comodo on the list of bad CAs one should avoid too?
    - yvesmh 10y ago
      You're probably thinking of https://news.ycombinator.com/item?id=11961034 https://news.ycombinator.com/item?id=11961034
ylere 10y ago
Well shit. I always liked StarCom because of their approach to charge for verification (with increasing costs for each higher trust level) but not for issuing certs (while still manually checking every cert request, at least for any OV&EV cert in my case). This entire WoSign acquisition is incredibly shady. Shortly after that some of the customer reps had chinese names, service quality declined and we got offered to become an "Intermediate CA" (StartPKI) for 10k$/yr. What is the best alternative CA that also offers wildcard certificates (preferably with a similar business model)?
- finnn 10y ago
  What use case do you have for wildcards that you can't use Let's Encrypt or similar automated issuance? Just curious, as I've yet to hear a terribly compelling one...
  - ylere 10y ago
    Let's Encrypt cannot issue EV (green bar) certs, wildcard certs and certs with a validity longer than 90 days. While these are good features for many applications (i.e. a typical hosted website), there a lot of cases where that's not optimal: - EV (green bar) certs are required to increase customer trust (it may be mostly snakeoil, but the CA system is heavily flawed and we are still forced to rely on it anyway) - Applications where certs are used on other platforms than web servers (e.g. embedded devices, routers etc.) and 90-day renewals are not easy to implement in an automated way. - Wildcard certs are mostly useful for convenience reasons, e.g. to easily secure a changing number of hosts within certain (sub)domains/zones (especially when they are only or mostly used in internal networks). I agree that the need for wildcard certs is greatly reduced with let's encrypt and acme.
  - seanot 10y ago
    I have a site that creates a subdomain for each new enterprise account and all subdomains relay on one StartCom wildcard cert. Ultimately, I can write a script to create a let's encrypt cert for each new subdomain but I've got plenty of other work on my plate at the moment.
  - 10y ago
driverdan 10y ago
TL;DR: > Taking into account all the issues listed above, Mozilla’s CA team has lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA. Therefore we propose that, starting on a date to be determined in the near future, Mozilla products will no longer trust newly-issued certificates issued by either of these two CA brands. I recommend reading the whole thing if you have time. They used some shady tactics.
tomjen3 10y ago
How can I check if I am using one of their certificates?
Angostura 10y ago
I'm going to make a donation to Mozilla for this. Top work of public value.
Ruud-v-A 10y ago
I’m glad that I have been distrusting Startcom on all my devices since early 2014. Time to do the same for Wosign.
Negitivefrags 10y ago
I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position. You can't support Windows XP users who use IE anymore with HTTPs. In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore. In china though, that number is still >5%, and I got that number personally from the metrics of a game that we just deployed an alpha for in China. I would bet that given the way the alpha test keys were handed out that the amount of Windows XP users in the general population is probably much much higher. So what is the response if you can't support a significant portion of your user base? Well for a bunch of chinese websites the result is don't use HTTPS at all. We have seen advice that "HTTPS cases problems for users in China so we think it's a bad idea to use it". It's not a good situation.
- jvehent 10y ago
  > You can't support Windows XP users who use IE anymore with HTTPs. Sure you can. Just ask a CA that has an old root trusted by XP but no longer trusted by modern browsers, and they'll issue a SHA-1 cert for you without risking to get kicked out of the truststores.
  - Negitivefrags 10y ago
    And what about all the modern browsers you also need to support?
    - agwa 10y ago
      You serve them a SHA-2 certificate. (In TLSv1.2 the client's supported hash algorithms are included in the handshake. Clients that don't support TLSv1.2 are probably fine with SHA-1. You can also use heuristics based on the ciphersuite to determine whether a client should get a SHA-1 certificate or not.)
    - pfg 10y ago
      It's possible to determine whether a client supports certificates using SHA-2 by analyzing the ClientHello and use that to switch between a SHA-1 and SHA-2 certificate. CloudFlare[1] and some of the bigger sites like Facebook have done this. [1]: https://blog.cloudflare.com/sha-1-deprecation-no-browser-left-behind/ https://blog.cloudflare.com/sha-1-deprecation-no-browser-lef...
xenophonf 10y ago
Well, this is as good a week as any to migrate my certificates to Let's Encrypt. I just need to figure out how to do domain validation.
- compuguy 10y ago
  I stopped using startcom after their response to the heartbleed vulnerability.
  - xenophonf 10y ago
    That really should have been my clue.
johnp_ 10y ago
I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is there a reason as to why this event hasn't been included in the document? edit: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security... > "In no case were these the deciding votes."
- phonon 10y ago
  It's in the wiki https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues
  - johnp_ 10y ago
    Could you please refer to the actual Issue? I can neither find anything related to the CA/B-Forum voting fraud nor to the yet unresolved Qihoo relationship.
    - phonon 10y ago
      Issue R? https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_of_StartCom_.28Nov_2015.29 https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_... Which links to https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security...
- pfg 10y ago
  The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1]. [1]: https://twitter.com/sleevi_/status/780454860676149248 https://twitter.com/sleevi_/status/780454860676149248
  - johnp_ 10y ago
    Thank you, though the Qihoo relationship is not what I was referring to. I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?
bandrami 10y ago
Nuke it from orbit. The whole idea of PKI is Broken and Wrong and confuses two different goals. Here's a fun one I noticed: Wells Fargo and several other banks are CAs. This is idiotic. The "logic" behind PKI dictates that it's a third party identifying my bank to me. If banks themselves are CAs even that fig leaf doesn't mean much. We have known bad actors in the pool of widely accepted CAs, right now. There's no sense bringing up obscure possibilities of MitMs that might happen absent a CA system: we have bogus certs, in the wild, today. Nuke it from orbit and teach people to pin certificates.
- jrochkind1 10y ago
  > The "logic" behind PKI dictates that it's a third party identifying my bank to me Not true. The third party is an operational detail to scale, there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? You're suggesting that you don't trust your bank's opinion on what websites belong to them, but do trust some third party's? Even if this made any sense, the third party is doing nothing but taking the bank's word for it, if a bank for some reason _wanted_ to affirm that some random domain was EV-certified as Wells Fargo, they surely could, even if they weren't the CA -- that's just not a threat the CA model is designed against.
  - bandrami 10y ago
    there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? Yes, there is. The list of entities I actually care about authenticity for are vanishingly small, basically just financial institutions and CAs themselves (for all other communication I don't trust who I think I'm talking with any more than I would trust a hypothetical man in the middle, so authenticity doesn't give me anything there). But for that small group, I definitely want an entity other than whoever controls their IT infrastructure to be verifying they are who they say they are. Meanwhile, all of the dicking around these attempts at preventing largely-hypothetical active attacks have stalled simply solving the much-easier and arguably more-important issue of simply securing transport against passive attacks. Connecting to TLS to news.ycombinator.com is nice in that I know nobody has read or altered the message in transit. The fact that a third party vouches that news.ycombinator.com is who they say they are doesn't add anything for me, because I don't trust news.ycombinator.com any more than I would trust somebody impersonating news.ycombinator.com. The CA in this situation simply complicates things and adds nothing for me.
stonogo 10y ago
Now that StartSSL is effectively deceased, is there a commercial CA that supports the ACME protocol? Or is the ACME protocol a vanity project unique to Let's Encrypt? I manage several dozen certificates; I was very pleased when StartSSL offered an automated API to work with. Despite their flaws, they offered EV certs, wildcards, and automated one-shots, and it was very convenient. I'd gladly pay for this functionality, preferably while supporting standards-based ACME functionality... but so far it seems Let's Encrypt is the only one playing that game, and their featureset is crap for anything but their very narrow use case. Any advice, HN?
- agwa 10y ago
  I'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: https://sslmate.com https://sslmate.com Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.
  - scrollaway 10y ago
    What's your take on the Comodo trademark claim on Let's Encrypt, and all the BS that ensued? https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583 I personally immediately replaced all of my and my company's comodo certificates with DigiCert ones.
    - abraae 10y ago
      Crazy Comodo. When that happened I resolved to never renew or buy new Comodo certs. It might be that Comodo backed away from that ridiculous plan but to be honest I don't really care - the CEO portrayed himself as a douche and it seems safe to assume they're a toxic company.
    - agwa 10y ago
      The incident was terrible, but it is not a reflection on how their CA is run. They run a trustworthy CA and employ some really awesome and competent people (e.g. Rob Stradling) who actively contribute to improving the Web PKI, such as by (co-)authoring the CAA, Must-Staple, and Certificate Transparency standards. They run https://crt.sh https://crt.sh, which is an invaluable resource for investigating Web PKI problems (the Mozilla report and associated mailing list threads are peppered with crt.sh links). If their trademark filings had amounted to actual legal threats against Let's Encrypt I would hesitate to send them business, but it seems more like their CEO is just a giant blowhard. The good they do makes up for it. In contrast, I'm much more appalled by Symantec/GeoTrust's misdeeds (e.g. issuing unauthorized "test" certificates for google.com, badly botching the SHA-1 deprecation, cross-signing the US Federal PKI). I think Symantec is incompetent and contributes negatively to the Web PKI. I no longer issue their certificates by default, and am going to replace them with a different CA.
coverband 10y ago
Shoot, I just renewed two of my domains with the free StartCom certs on Friday... Even though I'll likely have minimal-to-no impact, I'm still very disappointed with this.
zmmmmm 10y ago
It's a shame it sounds like there are no legal avenues for penalising the individuals behind this. Actions like this ought to be criminal. In the end, if the only penalties are directed at corporations involved it isn't much a of disincentive to state actors or others with sufficient resources who want to game the system.
- MaulingMonkey 10y ago
  Individuals? This sounds like a systemic organizational issue. I'm sure we can drum up a few scapegoats, but I'm not sure if that'll be terribly effective in fixing the incentives. Putting everyone involved out of a job and destroying whatever investments in the company they may have had, on the other hand, puts pressure on everyone involved to not fuck up next time.
appleflaxen 10y ago
Corporate personhood is an American thing, but if the CA can't perform their most fundamental function (certifying accurate information), isn't that the best possible case for the corporate death penalty? A 1-year time-out is insufficient to regain trust, IMO. I would never let them return, absent some kind of additional (exculpatory) information) They won't even admit to their behavior!
- icebraining 10y ago
  Corporate personhood is not an American thing. It appeared in the UK in the 1800s and it's now common across the world.
Kovah 10y ago
As someone who's using StartCom for several years I'm really anxious now. I may use Let's Encrypt for a few sites but not for all and I also got my email certificates from StartCom. As far as I know there's no suitable alternative that does not cost $500+ per year, or does anyone have an advice for me?
- byuu 10y ago
  I hate to say it, but if you need the functionality that Let's Encrypt won't offer (wildcard certificates, longer validity lengths, not wanting/needing to run certbot, code signing, etc) ... your best bet is to look for the SSL resellers. I'm not going to name the one I used (as I'm not marketing for them), but I purchased a three-year AlphaSSL wildcard certificate recently for a little over $110 (for all three years, so less than $40/yr.) It ... absolutely defies common sense that certificate resellers are a thing; but indeed it's the very same certificate I'd have gotten had I paid $150/yr on AlphaSSL's site. The CA model is just completely broken. But right now, our only choice is to find the lowest amount of money to be taken for if we want full HTTPS functionality. And at the moment, that's with the resellers :/
  - 0x0 10y ago
    It's funny but I've seen the same thing with virtual carriers for mobile phones. The big name brand can charge a premium because lots of people feel uneasy going with a no-name service. Then they turn around and grab the rest of the market, the price conscious consumers, with an off-brand, avoiding damaging their big name revenue. I'm sure there's even people believing "if it costs more it must be better".
  - caf 10y ago
    It ... absolutely defies common sense that certificate resellers are a thing I think that's the kind of thing you should expect in any market where the cost of serving a new customer is dominated by the marketing & sales costs in acquiring that customer.
byuu 10y ago
Wow, this would be devastating if they actually went through with revoking their root certificate. StartCom is (well, was) the only competition to Let's Encrypt in the free certificate space. It is far and away the cheapest direct provider of wildcard certificates (which are impossible to get for free), unless you move into reseller territory. And even their free certificates last four times as long, and don't require the use of certbot. Certainly, Let's Encrypt works great for a lot of peoples' needs. But for those it doesn't (and there's more of them than you might think), this is seriously bad news. It's easy to get onboard wanting to punish WoSign/StartCom here, but keep in mind that this has the potential to screw over all of their innocent customers as well. (Future customers with the first action; all customers if the second action comes to pass and they revoke the root CA.) And screwing them could likely mean they abandon HTTPS completely instead. Note that I am not advocating for Mozilla to give them a pass; far from it. If anything, this is just one more indictment on the long list of reasons why the entire CA system is completely broken. I actually just recently purchased a certificate, and had my choices narrowed down to StartSSL or AlphaSSL. I am really glad I went with the latter right about now. I can't tell you how absolutely livid I would become if Mozilla ended up revoking my root CA after dropping over $100 on my certificate.
- homero 10y ago
  True but you're forgetting that it may be cheap to cover up shady certs they throw in, distraction. Like all the money laundering resorts in Cancun.
- yrro 10y ago
  Surely you could have demanded a refund if you had chosen StartSSL and they sold you what turned out to be a defective product?
  - inimino 10y ago
    Good luck collecting after the company's potential future revenue has been erased.
    - 10y ago
Fej 10y ago
I am both surprised and immeasurably pleased at the sight that "too big to fail" isn't (yet) reality for CAs. When it comes to shady shit like this... I would reference the title of Metallica's first album.
brongondwana 10y ago
While I agree that they did the wrong thing and WoSign/StartCom should be punished for lying, the whole sha-1 deprecation thing is very black and white. Others have successfully gained "exemptions" to do precisely this, and it's an interesting question whether it would have been easy for WoSign to get those same exemptions if they'd just asked. I bet the answer is "possible but not easy". Meanwhile: http://security.stackexchange.com/questions/86609/this-is-2015-has-sha1-been-exploited-or-cracked-yet http://security.stackexchange.com/questions/86609/this-is-20... https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html https://www.schneier.com/blog/archives/2015/10/sha-1_freesta... "Freestart collisions, like the one presented here, do not directly imply a collision for SHA-1" "this work is an important milestone towards an actual SHA-1 collision" https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 "SHA-1 is no longer considered secure against well-funded opponents". AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Given the reported 5%+ of Chinese browsers not supporting newer certs, I can see why customers might want a cert that gives them a lot more than nothing, though less than best-of-breed. It's the one-size-fits-all where someone's personal blog needs to have the same level of security as the apple app store's payment system that leaves them filling a real market need. They didn't go seeking people wanting SHA1 certs, people wanting SHA1 certs that would still work went seeking someone who would provide them. And they went seeking because the alternative is upgrading potentially millions of dollars worth of embedded kit which doesn't support newer certs, all to secure one link in a chain in which SHA1 is nowhere near the weakest link. So yeah, the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded in order to push a more secure ecosystem on everybody. Which is great from some perspectives, but it's environmental vandalism from another perspective, and if it pushes people back to non-HTTPS traffic for those older pieces of equipment it could cause a short term worsening of security. (the deprecation of sha1 that is. The lying by WoSign/StartCom was a calculated risk in a business where everything is based on trust, and they lost)
- takluyver 10y ago
  > I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem. > someone's personal blog needs to have the same level of security as the apple app store's payment system Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception. It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so. > the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.
ara24 10y ago
Is there a governing body or regulatory authority which looks over the process followed by CAs ? As a fan of firefox, I am happy that as a community, Mozilla has done the necessary ground work to reach this conclusion. However, as long as PKI remains a highly profitable business, more and more such events are going to happen. I don't think all CAs should be trusted equally. Right now, AFAIK, my browsing experience is only as secure as the weakest CA. Hopefully, HPKP can put an end to this.
lionradio 10y ago
I think Mozilla is falling for Symantecs / other CAs propaganda here. Yes, WoSign did bad things, but those are by far not the worst things we've seen in CA wrongdoings in the last years. We've seen certs issued for MITM attacks and security holes in the validation process of nearly every CA. (http://www.theregister.co.uk/2012/02/14/trustwave_analysis/ http://www.theregister.co.uk/2012/02/14/trustwave_analysis/) < they confessed issuing a cert for MITM purpose and are still part of the game. The allegations mainly consist of: a) WoSign didn't make transparent that they have control over StartCom. Yes, this is a thing and it should be discussed. But the main focus of this is obviously to get StartCom into this story. Where - as I understood it - there is no allegation, that StartCom itself did something wrong. At least not in the league of "we should kill that company". Transparency is important and we should fight for it. Not only in China. b) They backdated SHA-1 certs. Obviously because not updated Windows XP machines are a thing in China. This is against code of conduct. This is bad, but I totally get the intention here. And the intention is not MITM attacks or worse (as we see a lot in CA business) the intention is not to break Chinese internet. Bottom line: "Let's encrypt" is destroying the business of many shady CAs these days. Competition is getting harder. StartCom had an advance in this race as they adopted quickly to the new rules and the've build the best product in the market for special use cases. We - for example - rely on a lot of wildcard certs for many domains. StartCom had the product. We pay'd them $200 for all our certs and the next cheapest competitor wanted $150.000 / year for our certs. I totally get why they are getting attacked by the big players. I totally don't get why Mozilla is falling for this.
- pfg 10y ago
  There were a number of other issues that came up during this investigation that showed that they should not be running a CA[1]. For example, they issued certificates to anyone able to control a unprivileged port (> 1024) behind a domain. They issued certificates for "root domains" to anyone able to verify control of a subdomain. When StartCom launched their issuance API, it was taken down within a matter of days due to some pretty obvious holes. The biggest problem with the SHA-1 issuance is that they - as the report shows - blatantly lied about how this played out during the investigation and did not even attempt to go through the proper channels to get an exception from browser vendors (which other CAs did). Additionally, issuing a SHA-1 certificate to a payment processor that failed to upgrade their systems in time cannot be explained by China having a large number of XP <= SP2 users. That's just an excuse. Regarding the TrustWave incident a few years back, it's important to understand that this happened when the rules for CAs were not quite as clear as they are now. I think this happened just around the time when the Baseline Requirements were written and were not yet in effect, and various browser policies were not as clear as they could've been about this use-case. Four years later, I have no doubts that a CA who'd give out the private key of a non-constrained CA certificate to a non-audited third-party would lose their trust status within a matter of days. [1]: https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues
jhorna003 10y ago
If you have a small budget but do not want to miss out on the excitement of a Galapagos Islands cruisehttps://www.galapagosdanatours.com/galapagos-cruises/ https://www.galapagosdanatours.com/galapagos-cruises/ the tourist class might be right for you.

608 points by aestetix 10y ago

hart_russell 10y ago

A 1 year suspension and continued trust of previously signed certificates? Sounds very generous to me.

geofft 10y ago
It's generous to the customers who currently have existing, valid WoSign or StartCom certificates. It's not very generous to WoSign or StartCom as continuing profitable businesses, because if I were paying either of these companies for certificates, I'd be looking for someone else to pay when it comes time to renew. This is exactly what you want.
throwawayReply 10y ago
With a "play by the rules or you're out" attached. It's more lenient than some might want, but it avoids the decision being controversial and perhaps lessens the chance that it is seriously challenged.
TorKlingberg 10y ago
It's not a 1 year suspension. It's a 1 year complete ban, then they may apply again from scratch, with extra requirements.
tptacek 10y ago
How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor (raises hand! pick me!) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear. StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue. You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.
- bcg1 10y ago
  Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.
  - tptacek 10y ago
    It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.
    - jvehent 10y ago
      Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA. That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.
    - xnyhps 10y ago
      Or buy yet another CA and continue under their name?
    - x0x0 10y ago
      There should be a 1-year plus ban on principals as well.
- bandrami 10y ago
  Yeah but the existing certs are still out there. While it's great that a company is being punished, this completely ignores the fact that we have no idea what they've signed, and short of laboriously checking the trust path of every single certificate you encounter there's no way to know if the cert you're looking at at any given moment came from them or not. And worse yet, the bigger problem is there's not a practical way to actually yank all of the certificates they signed that will work for arbitrary clients who don't know anything about this process to begin with and just look for a lock in the address bar, if that.
gregmac 10y ago
With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [..] Our proposal is that we determine “newly issued” by examining the notBefore date [...] therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
jerf 10y ago
To the other observations, I'd also observe that in a world of corporate entities, there isn't a meaningful way to permanently eliminate a CA. Bad actors can always dissolve the old entity, form a new one with the same policies and any of the same people you'd like, and do the same thing. Banning the existing corporation for a year is about all you can do; the more time that goes by the fuzzier it becomes as to what exactly that "entity" is. By far the more important element here is not that the specific corporate entity gets nuked, but that it be demonstrated to all and sundry that the CA standards have teeth. That is what will keep the bad actors from "just" doing anything to get around the problem, not psychologically-appealing vengeance.
oxguy3 10y ago
Given WoSign's history of backdating SHA-1 certificates in violation of Mozilla's rules, I wouldn't be too surprised if they reuse that practice to get around the 1 year ban, at which point Mozilla will have to consider permanently distrusting them.
- nandhp 10y ago
  They've already considered it and are including this in their proposal: > WoSign/StartCom could back-date certificates to get around this restriction. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
  - Paul-ish 10y ago
    Would they do this out of spite? StartCom is essentially done for and has little to lose, so out of bitterness they could try to turn their customers against the browser vendors.

geofft 10y ago

This is a very detailed investigation - the parts that appear to be new are the specific serial number patterns, the times/dates of manual issuance, and the case of the Tyro SHA-1 cert. It's a little unfortunate that Mozilla's option here is to rely on WoSign and StartCom continuing to be honest about notBefore, or really, on Google detecting further abuse of notBefore via Certificate Transparency. Mozilla should really be participating in CT themselves so they have more options here. Is there anything the community can do to help (e.g., run more log servers)?

xnyhps 10y ago
> Google detecting further abuse of notBefore via Certificate Transparency You don't need to rely on Google. All certs issued by WoSign since January 1st, 2015 should be on WoSign's own Certificate Transparency log from which you can download them. StartCom is logging all new certs too, but I don't know for sure if they pushed all older ones too. If you ever encounter a cert that isn't on the list, that's definitive proof that they are backdating again. The list of certificates is too large for Mozilla to include a list of hashes in Firefox, but it might be a nice opportunity for a Firefox add-on.
- dspillett 10y ago
  > You don't need to rely on Google ... should be on WoSign's own Certificate Transparency log which you can download Given that the behaviours being documented include falsifying data (backdating certificates to get around SHA1 retirement), I would prefer to at least use information from Google (or another third party) for the purpose of verification, rather than just relying on information sourced from WoSign/StartCom.
  - xnyhps 10y ago
    They can't backdate their Certificate Transparency log without leaving cryptographic evidence behind. That's how CT is designed to work. Of course, simply being in the log doesn't imply the cert was issued correctly, but the logs have been posted for a couple of months now and have received a lot of scrutiny during Mozilla's investigation. But the same is true for Google's log, presence in that log is also no guarantee that it was issued correctly.

crazypyro 10y ago

Completely and utterly fail your job, lie about it and use deceiving tactics? And all they are getting is a 1 year suspension and none of the certificates are becoming untrusted. The auditors got a bigger punishment by being banned completely from Mozilla's trusted auditors. Should just revoke them completely. Such incompetence and/or malice should not be allowed on such a crucial piece of infrastructure.

geofft 10y ago
Revoking them completely would be a pain for end users of StartCom and WoSign certificates, who had no way to know that their CA was incompetent and/or malicious. But this is a great way to choke out their business by the end of a year, since they can't sell any new products. Of course, it might be nice to actually revoke them so that in the future, "will my CA be revoked" is a realistic thing to think about when choosing a certificate seller. But revocation hurts other people (website owners and visitors) more than the CA, and it doesn't seem totally obvious that it's worth it.
- no_protocol 10y ago
  Is there a compiled listing of all CA audits (good and bad) and "offenses" so a prospective customer might be able to choose a CA based on past performance rather than marketing materials?
- wyager 10y ago
  Who cares if it's a pain? User security is vastly more important than saving companies from the mild inconvenience of changing certs.
  - tptacek 10y ago
    The fact that they're honoring previous certificates is a good thing. It's a demonstration from Mozilla and Google that CAs with large customer bases have very little leverage in disputes like this: Mozilla will respond with the corrective measure that causes maximum pain for the CA business and minimal pain for the CA's previous customers.

no_protocol 10y ago

A clear and detailed report. The conclusion seems both transparent and fair. It would be very difficult for many customers of StartCom/WoSign if they were immediately revoked. Hopefully this news spreads far enough that the reputation of StartCom/WoSign will generally include this information. I am saving this as a reference in the event I ever need to write a technical report. This style is so much easier to read than a typical "official" report from police, the FBI, or similar organizations. I don't have any StartCom or WoSign certificates right now, but I did in the past. It was nice to be able to get a certificate that browsers accepted, without needing to pay for it. I'm glad the landscape has changed.

TorKlingberg 10y ago
Yes, we are very fortunate to have Let's Encrypt now.
- justinclift 10y ago
  One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom. We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar). At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's an unknown. o_O
  - aroch 10y ago
    NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit. ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).
  - deleted 10y ago
    [deleted]
  - edwinyzh 10y ago

nandhp 10y ago

I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action against WoSign?

popey456963 10y ago
Considering I believe one of the writers of this was from Google, I guess we can assume they'll likely follow? With both Chrome and Firefox no longer allowing certificates from them we can expect customers to no longer buy from them which will result in no more certificates even if Apple/Microsoft don't follow.
- JonathonW 10y ago
  Does Chrome maintain its own trusted certificate list on any platform? IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.
  - pquerna 10y ago
    Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code: CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets https://dev.chromium.org/Home/chromium-security/crlsets HSTS Preloading: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ more: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
  - pkhagah 10y ago
    Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...

koolba 10y ago

I like this part at the end: > In addition, Mozilla will: > add all of the Macau certificates to OneCRL immediately; > and no longer accept audits carried out by Ernst & Young (Hong Kong). If you don't hold the auditors responsible, this will happen again. If you do hold the auditors responsible, you might prevent some of this.

tux3 10y ago

>We also hope the public can see that when there are allegations of CA wrongdoing, Mozilla is committed to a fair, transparent and thorough investigation of the facts of each case. I'm very happy to see the way Mozilla handled this incident, both with the process and the conclusion. I have a moderate trust in the CA ecosystem as a whole, but I'm glad to see that overwhelming incompetence, if not outright maliciousness, does have consequences even to big CAs. At first though the proposed one year timeout can seem a little short given the impressive list of reported issues, but the conditions given for re-acceptance are strict enough that passing could only indicate a radical change in methodology, at which point it would only make good sense to consider a re-inclusion. In fact if every CA could take a full code security audit and provide complete certificate transparency in the manner proposed, I think we would have reason to feel marginally safer on the Internet.

mtgx 10y ago
My hope would be that since this method of punishing seems to be liked by most and even feels "generous" to some, the browser vendors would more aggressively start handing out "1 year suspensions" for more and more CAs that are caught doing anything even remotely like this. Then after a year or two, and after the CAs have learned that they need to take this stuff seriously, and yet some still get caught doing it, the browser vendors should increase the level of punishment, because those getting caught then wouldn't have much of an excuse anymore.
- tptacek 10y ago
  The people saying this is "generous" are making largely irrational arguments. What Mozilla is proposing is the worst case for incumbent CAs.
  - tajen 10y ago
    > worst case Can you develop please? To me it seems that the worst case would be an immediate and permanent revocation of their certs because of fraud. I find Mozilla/Google very lenient in this affair, and that's probably because I don't understand what's the problem with revoking a CA with short notice. Ok it's annoying for customers, but they just have to subscribe to a new CA and install the new cert. It's annoying but it's a security emergency. If your bank was physically guarded by a security company who has been found to replace agents with puppets in 62 Macau banks, wouldn't the head of security interrupt their week-end to guard the bank and contract a new company? If CA revocation takes customers by surprise today, it's time to start revoking certs more regularly. Heck, if you don't answer to a request from your domain provider within 15 days, your domain can even be revoked. CAs are more important than that.

guelo 10y ago

If the CA market were efficient this would lead to bankruptcy of this company since there's no reason to chose them over the many competitors and many reasons to distrust them. Though of course the market is not efficient. I keep wondering when the Communist Party of China is going to make its heavy handed presence felt in the CA world.

gcp 10y ago
The browsers will distrust the CA. Which will, in all likelyhood, lead to their bankruptcy.
- voltagex_ 10y ago
  Will they? Still gotta wait for Google, Microsoft and Apple. Is there any mechanism to push certificate updates to Android devices in the wild? Otherwise there's going to be a lot of devices that trust WoSign and StartCom, no matter what.
  - johncolanduoni 10y ago
    Chrome doesn't have their own certificate store, instead they use the platform's certificate store with some logic layered on top (e.g. requiring new Symantec certificates to be in the certificate transparency logs). So an update to the Chrome app on Android could implement Mozilla's plan, or something even more extreme.
  - vertex-four 10y ago
    In practice, nobody is going to buy a cert for general web use which doesn't work for Firefox. They could scale back drastically and focus on internal certs and certs for other uses, but that might not be enough to keep them afloat, especially with the reputation damage from this.
lolc 10y ago
Even after this disclosures, a fully informed, rational agent would still choose WoSign if their price and service were the best. This is because WoSign's behavior does not specifically endanger their customers. The SSL ecosystem relies on the trustworthiness of the certificate authorities. If one of them is compromised, the whole system is compromised, not just their customers. This cannot be solved by markets. Instead, it's heavily regulated.

tptacek 10y ago

Mozilla and Chrome are killing StartCom. This is huge, isn't it? StartCom is one of the more popular CAs. Later: Additional fun fact: there's a decent-sized subthread on the mailing list in which it's strongly suggested that WoSign is itself quietly owned by Qihoo360, a much larger company --- somewhat like the Symantec of China. More specifically: https://twitter.com/pzb/status/780456712562024448 https://twitter.com/pzb/status/780456712562024448

blibble 10y ago
after their heartbleed extortions they really deserve nothing less (and yes, I was a paying customer)
- dspillett 10y ago
  While their current/recent behaviours that are being discussed are deplorable, I don't think the heartbleed thing is as morally corrupt as many people affected make out. Their rules always clearly stated the cost of replacement certificates and that this would only be waived if the replacement was needed due to their fault. As heartbleed was not a problem they caused they were well within their agreements with the customers to charge for revoking and resigning certificates. They missed a chance at earning "good faith points" but they presumably didn't value that over the income from resigned certificates. They are a commercial body afterall. Lets not dilute the discussion of cases where they appear to have been deliberately fraudulent by mixing in a past occurrence of them simply being uncaring.
  - joepie91_ 10y ago
    Oh come on, I get really tired of this "well, that's what the agreement said". Revocation is a critical part of a well-functioning CA system, and charging for revocations of free certificates actively puts that at risk, because it disincentivizes people from revoking potentially-compromised certificates - that is why it's morally corrupt. > They are a commercial body afterall. That's their problem, and putting the CA system at risk because "well, we have to make money somehow" is not even remotely acceptable.

joseignaciorc 10y ago

Just curiosity: since this report is a Google Doc, how can one know that it has been really written by Mozilla? Shouldn't it be under the mozilla.org domain?

tptacek 10y ago
It was written by multiple authors. Ryan Sleevi is at Google.
gcp 10y ago
The link was posted via mozilla.dev.security.policy
deleted 10y ago
[deleted]
bratch 10y ago
Being hosted where it is is particularly annoying because you can't view it unless you accept cookies from google.com. A JavaScript redirect takes you straight to https://support.google.com/accounts/answer/32050 https://support.google.com/accounts/answer/32050.
Ajedi32 10y ago
Well, here's the link to the document from the Mozilla Security mailing list: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/NAH6NVf3JPI https://groups.google.com/forum/#!topic/mozilla.dev.security... > Because this document is extensive and contains embedded images, links and formatting, I have published it on Google Docs instead of as an email message here: https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/edit https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBG...

sandGorgon 10y ago

why is this google docs ? why is this not atleast a markdown file in github ?

popey456963 10y ago
From tptacek: "It was written by multiple authors. Ryan Sleevi is at Google." I would assume the method it was written in is of little consequence to many, just that Google Docs offer far better convenience when working in teams.
Sanddancer 10y ago
This is a working draft of a findings document that's being actively edited. Google Docs allows for realtime cooperative collaboration, with nice features like chat and annotation of documents. There are a few other collaborative editing systems out there, but they tend to have more hitches than google docs'

gregmac 10y ago

I think this is very well handled on the part of Mozilla, especially with respect to existing customers. What's missing, which admittedly is not Mozilla's job, is to inform any existing customers that will have to renew during the time WoSign and StartCom are suspended. If they just get an invoice and pay it or are set-up with auto-renew, they'll unknowingly get certificates that aren't valid for the remainder of the suspension (or indefinitely, if WoSign/StartCom if violates Mozilla's requirements).

tarancato 10y ago

So I don't like Let's Encrypt, if Mozilla "kills" WoSign/StartCom, what are my options if I want a cert for free?

gcp 10y ago
Any other CA?
chias 10y ago
If you write off Let's Encrypt, I think your options will be limited to "pay for a certificate".
oxguy3 10y ago
What exactly don't you like about Let's Encrypt? Besides Let's Encrypt, your other option is paying for a cert from GoDaddy or something. My two cents: don't give business to Comodo, given their horrible track record of sleaziness (https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies).
- tarancato 10y ago
  I don't like the EFF, but I guess I will have to use Let's Encrypt if there's no other option.
  - rudolf0 10y ago
    If I might ask, why don't you like them?
    - tarancato 10y ago
      They are a political organisation and their ideas conflict with mine. I don't keep a strong boycott on them, but I don't want to support their products, that's all.
      - 10y ago

pquerna 10y ago

While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting: > no longer accept audits carried out by Ernst & Young (Hong Kong). To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.

chillydawg 10y ago
Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.
- pquerna 10y ago
  Completely Agree! When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.
tomjen3 10y ago
Isn't that only E&Y Hong Kong, though? Really at this point I don't know why anybody in China, or any country known for its corruption, should be accepted as auditors.
- jrockway 10y ago
  You're painting 1 billion people with a rather broad brush.
  - rocqua 10y ago
    He's only painting the authorities of those people with a broad brush. If something was confirmed from a chinese authority (private or public) would you trust that more, less, or the same due to the 'chinese' specifier?

shawkinaw 10y ago

Goddammit. I really liked StartCom for free S/MIME certificates and TLS certs that don't expire after a month. So people, is there a comparable free product out there (don't say LetsEncrypt, they don't do S/MIME unless I'm mistaken)?

tptacek 10y ago
Why are you using S/MIME? You can still get free S/MIME certs from Comodo.
- shawkinaw 10y ago
  Mostly for fun.
- carsonreinke 10y ago
  What is wrong with S/MIME?
  - TD-Linux 10y ago
    It has less users than PGP/MIME, which is an impressive feat.
    - tgsovlerkhgsel 10y ago
      Since many major clients support it out of the box, I'd say that at least for verification purposes, it has more users than PGP/MIME.
- TeMPOraL 10y ago
  Wasn't Comodo on the list of bad CAs one should avoid too?
  - yvesmh 10y ago
    You're probably thinking of https://news.ycombinator.com/item?id=11961034 https://news.ycombinator.com/item?id=11961034

ylere 10y ago

Well shit. I always liked StarCom because of their approach to charge for verification (with increasing costs for each higher trust level) but not for issuing certs (while still manually checking every cert request, at least for any OV&EV cert in my case). This entire WoSign acquisition is incredibly shady. Shortly after that some of the customer reps had chinese names, service quality declined and we got offered to become an "Intermediate CA" (StartPKI) for 10k$/yr. What is the best alternative CA that also offers wildcard certificates (preferably with a similar business model)?

finnn 10y ago
What use case do you have for wildcards that you can't use Let's Encrypt or similar automated issuance? Just curious, as I've yet to hear a terribly compelling one...
- ylere 10y ago
  Let's Encrypt cannot issue EV (green bar) certs, wildcard certs and certs with a validity longer than 90 days. While these are good features for many applications (i.e. a typical hosted website), there a lot of cases where that's not optimal: - EV (green bar) certs are required to increase customer trust (it may be mostly snakeoil, but the CA system is heavily flawed and we are still forced to rely on it anyway) - Applications where certs are used on other platforms than web servers (e.g. embedded devices, routers etc.) and 90-day renewals are not easy to implement in an automated way. - Wildcard certs are mostly useful for convenience reasons, e.g. to easily secure a changing number of hosts within certain (sub)domains/zones (especially when they are only or mostly used in internal networks). I agree that the need for wildcard certs is greatly reduced with let's encrypt and acme.
- seanot 10y ago
  I have a site that creates a subdomain for each new enterprise account and all subdomains relay on one StartCom wildcard cert. Ultimately, I can write a script to create a let's encrypt cert for each new subdomain but I've got plenty of other work on my plate at the moment.
- 10y ago

driverdan 10y ago

TL;DR: > Taking into account all the issues listed above, Mozilla’s CA team has lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA. Therefore we propose that, starting on a date to be determined in the near future, Mozilla products will no longer trust newly-issued certificates issued by either of these two CA brands. I recommend reading the whole thing if you have time. They used some shady tactics.

tomjen3 10y ago

How can I check if I am using one of their certificates?

Angostura 10y ago

I'm going to make a donation to Mozilla for this. Top work of public value.

Ruud-v-A 10y ago

I’m glad that I have been distrusting Startcom on all my devices since early 2014. Time to do the same for Wosign.

Negitivefrags 10y ago

I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position. You can't support Windows XP users who use IE anymore with HTTPs. In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore. In china though, that number is still >5%, and I got that number personally from the metrics of a game that we just deployed an alpha for in China. I would bet that given the way the alpha test keys were handed out that the amount of Windows XP users in the general population is probably much much higher. So what is the response if you can't support a significant portion of your user base? Well for a bunch of chinese websites the result is don't use HTTPS at all. We have seen advice that "HTTPS cases problems for users in China so we think it's a bad idea to use it". It's not a good situation.

jvehent 10y ago
> You can't support Windows XP users who use IE anymore with HTTPs. Sure you can. Just ask a CA that has an old root trusted by XP but no longer trusted by modern browsers, and they'll issue a SHA-1 cert for you without risking to get kicked out of the truststores.
- Negitivefrags 10y ago
  And what about all the modern browsers you also need to support?
  - agwa 10y ago
    You serve them a SHA-2 certificate. (In TLSv1.2 the client's supported hash algorithms are included in the handshake. Clients that don't support TLSv1.2 are probably fine with SHA-1. You can also use heuristics based on the ciphersuite to determine whether a client should get a SHA-1 certificate or not.)
  - pfg 10y ago
    It's possible to determine whether a client supports certificates using SHA-2 by analyzing the ClientHello and use that to switch between a SHA-1 and SHA-2 certificate. CloudFlare[1] and some of the bigger sites like Facebook have done this. [1]: https://blog.cloudflare.com/sha-1-deprecation-no-browser-left-behind/ https://blog.cloudflare.com/sha-1-deprecation-no-browser-lef...

xenophonf 10y ago

Well, this is as good a week as any to migrate my certificates to Let's Encrypt. I just need to figure out how to do domain validation.

compuguy 10y ago
I stopped using startcom after their response to the heartbleed vulnerability.
- xenophonf 10y ago
  That really should have been my clue.

johnp_ 10y ago

I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is there a reason as to why this event hasn't been included in the document? edit: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security... > "In no case were these the deciding votes."

phonon 10y ago
It's in the wiki https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues
- johnp_ 10y ago
  Could you please refer to the actual Issue? I can neither find anything related to the CA/B-Forum voting fraud nor to the yet unresolved Qihoo relationship.
  - phonon 10y ago
    Issue R? https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_of_StartCom_.28Nov_2015.29 https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_... Which links to https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security...
pfg 10y ago
The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1]. [1]: https://twitter.com/sleevi_/status/780454860676149248 https://twitter.com/sleevi_/status/780454860676149248
- johnp_ 10y ago
  Thank you, though the Qihoo relationship is not what I was referring to. I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?

bandrami 10y ago

Nuke it from orbit. The whole idea of PKI is Broken and Wrong and confuses two different goals. Here's a fun one I noticed: Wells Fargo and several other banks are CAs. This is idiotic. The "logic" behind PKI dictates that it's a third party identifying my bank to me. If banks themselves are CAs even that fig leaf doesn't mean much. We have known bad actors in the pool of widely accepted CAs, right now. There's no sense bringing up obscure possibilities of MitMs that might happen absent a CA system: we have bogus certs, in the wild, today. Nuke it from orbit and teach people to pin certificates.

jrochkind1 10y ago
> The "logic" behind PKI dictates that it's a third party identifying my bank to me Not true. The third party is an operational detail to scale, there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? You're suggesting that you don't trust your bank's opinion on what websites belong to them, but do trust some third party's? Even if this made any sense, the third party is doing nothing but taking the bank's word for it, if a bank for some reason _wanted_ to affirm that some random domain was EV-certified as Wells Fargo, they surely could, even if they weren't the CA -- that's just not a threat the CA model is designed against.
- bandrami 10y ago
  there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? Yes, there is. The list of entities I actually care about authenticity for are vanishingly small, basically just financial institutions and CAs themselves (for all other communication I don't trust who I think I'm talking with any more than I would trust a hypothetical man in the middle, so authenticity doesn't give me anything there). But for that small group, I definitely want an entity other than whoever controls their IT infrastructure to be verifying they are who they say they are. Meanwhile, all of the dicking around these attempts at preventing largely-hypothetical active attacks have stalled simply solving the much-easier and arguably more-important issue of simply securing transport against passive attacks. Connecting to TLS to news.ycombinator.com is nice in that I know nobody has read or altered the message in transit. The fact that a third party vouches that news.ycombinator.com is who they say they are doesn't add anything for me, because I don't trust news.ycombinator.com any more than I would trust somebody impersonating news.ycombinator.com. The CA in this situation simply complicates things and adds nothing for me.

stonogo 10y ago

Now that StartSSL is effectively deceased, is there a commercial CA that supports the ACME protocol? Or is the ACME protocol a vanity project unique to Let's Encrypt? I manage several dozen certificates; I was very pleased when StartSSL offered an automated API to work with. Despite their flaws, they offered EV certs, wildcards, and automated one-shots, and it was very convenient. I'd gladly pay for this functionality, preferably while supporting standards-based ACME functionality... but so far it seems Let's Encrypt is the only one playing that game, and their featureset is crap for anything but their very narrow use case. Any advice, HN?

agwa 10y ago
I'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: https://sslmate.com https://sslmate.com Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.
- scrollaway 10y ago
  What's your take on the Comodo trademark claim on Let's Encrypt, and all the BS that ensued? https://news.ycombinator.com/item?id=11964583 https://news.ycombinator.com/item?id=11964583 I personally immediately replaced all of my and my company's comodo certificates with DigiCert ones.
  - abraae 10y ago
    Crazy Comodo. When that happened I resolved to never renew or buy new Comodo certs. It might be that Comodo backed away from that ridiculous plan but to be honest I don't really care - the CEO portrayed himself as a douche and it seems safe to assume they're a toxic company.
  - agwa 10y ago
    The incident was terrible, but it is not a reflection on how their CA is run. They run a trustworthy CA and employ some really awesome and competent people (e.g. Rob Stradling) who actively contribute to improving the Web PKI, such as by (co-)authoring the CAA, Must-Staple, and Certificate Transparency standards. They run https://crt.sh https://crt.sh, which is an invaluable resource for investigating Web PKI problems (the Mozilla report and associated mailing list threads are peppered with crt.sh links). If their trademark filings had amounted to actual legal threats against Let's Encrypt I would hesitate to send them business, but it seems more like their CEO is just a giant blowhard. The good they do makes up for it. In contrast, I'm much more appalled by Symantec/GeoTrust's misdeeds (e.g. issuing unauthorized "test" certificates for google.com, badly botching the SHA-1 deprecation, cross-signing the US Federal PKI). I think Symantec is incompetent and contributes negatively to the Web PKI. I no longer issue their certificates by default, and am going to replace them with a different CA.

coverband 10y ago

Shoot, I just renewed two of my domains with the free StartCom certs on Friday... Even though I'll likely have minimal-to-no impact, I'm still very disappointed with this.

zmmmmm 10y ago

It's a shame it sounds like there are no legal avenues for penalising the individuals behind this. Actions like this ought to be criminal. In the end, if the only penalties are directed at corporations involved it isn't much a of disincentive to state actors or others with sufficient resources who want to game the system.

MaulingMonkey 10y ago
Individuals? This sounds like a systemic organizational issue. I'm sure we can drum up a few scapegoats, but I'm not sure if that'll be terribly effective in fixing the incentives. Putting everyone involved out of a job and destroying whatever investments in the company they may have had, on the other hand, puts pressure on everyone involved to not fuck up next time.

appleflaxen 10y ago

Corporate personhood is an American thing, but if the CA can't perform their most fundamental function (certifying accurate information), isn't that the best possible case for the corporate death penalty? A 1-year time-out is insufficient to regain trust, IMO. I would never let them return, absent some kind of additional (exculpatory) information) They won't even admit to their behavior!

icebraining 10y ago
Corporate personhood is not an American thing. It appeared in the UK in the 1800s and it's now common across the world.

Kovah 10y ago

As someone who's using StartCom for several years I'm really anxious now. I may use Let's Encrypt for a few sites but not for all and I also got my email certificates from StartCom. As far as I know there's no suitable alternative that does not cost $500+ per year, or does anyone have an advice for me?

byuu 10y ago
I hate to say it, but if you need the functionality that Let's Encrypt won't offer (wildcard certificates, longer validity lengths, not wanting/needing to run certbot, code signing, etc) ... your best bet is to look for the SSL resellers. I'm not going to name the one I used (as I'm not marketing for them), but I purchased a three-year AlphaSSL wildcard certificate recently for a little over $110 (for all three years, so less than $40/yr.) It ... absolutely defies common sense that certificate resellers are a thing; but indeed it's the very same certificate I'd have gotten had I paid $150/yr on AlphaSSL's site. The CA model is just completely broken. But right now, our only choice is to find the lowest amount of money to be taken for if we want full HTTPS functionality. And at the moment, that's with the resellers :/
- 0x0 10y ago
  It's funny but I've seen the same thing with virtual carriers for mobile phones. The big name brand can charge a premium because lots of people feel uneasy going with a no-name service. Then they turn around and grab the rest of the market, the price conscious consumers, with an off-brand, avoiding damaging their big name revenue. I'm sure there's even people believing "if it costs more it must be better".
- caf 10y ago
  It ... absolutely defies common sense that certificate resellers are a thing I think that's the kind of thing you should expect in any market where the cost of serving a new customer is dominated by the marketing & sales costs in acquiring that customer.

byuu 10y ago

Wow, this would be devastating if they actually went through with revoking their root certificate. StartCom is (well, was) the only competition to Let's Encrypt in the free certificate space. It is far and away the cheapest direct provider of wildcard certificates (which are impossible to get for free), unless you move into reseller territory. And even their free certificates last four times as long, and don't require the use of certbot. Certainly, Let's Encrypt works great for a lot of peoples' needs. But for those it doesn't (and there's more of them than you might think), this is seriously bad news. It's easy to get onboard wanting to punish WoSign/StartCom here, but keep in mind that this has the potential to screw over all of their innocent customers as well. (Future customers with the first action; all customers if the second action comes to pass and they revoke the root CA.) And screwing them could likely mean they abandon HTTPS completely instead. Note that I am not advocating for Mozilla to give them a pass; far from it. If anything, this is just one more indictment on the long list of reasons why the entire CA system is completely broken. I actually just recently purchased a certificate, and had my choices narrowed down to StartSSL or AlphaSSL. I am really glad I went with the latter right about now. I can't tell you how absolutely livid I would become if Mozilla ended up revoking my root CA after dropping over $100 on my certificate.

homero 10y ago
True but you're forgetting that it may be cheap to cover up shady certs they throw in, distraction. Like all the money laundering resorts in Cancun.
yrro 10y ago
Surely you could have demanded a refund if you had chosen StartSSL and they sold you what turned out to be a defective product?
- inimino 10y ago
  Good luck collecting after the company's potential future revenue has been erased.
  - 10y ago

Fej 10y ago

I am both surprised and immeasurably pleased at the sight that "too big to fail" isn't (yet) reality for CAs. When it comes to shady shit like this... I would reference the title of Metallica's first album.

brongondwana 10y ago

While I agree that they did the wrong thing and WoSign/StartCom should be punished for lying, the whole sha-1 deprecation thing is very black and white. Others have successfully gained "exemptions" to do precisely this, and it's an interesting question whether it would have been easy for WoSign to get those same exemptions if they'd just asked. I bet the answer is "possible but not easy". Meanwhile: http://security.stackexchange.com/questions/86609/this-is-2015-has-sha1-been-exploited-or-cracked-yet http://security.stackexchange.com/questions/86609/this-is-20... https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html https://www.schneier.com/blog/archives/2015/10/sha-1_freesta... "Freestart collisions, like the one presented here, do not directly imply a collision for SHA-1" "this work is an important milestone towards an actual SHA-1 collision" https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 "SHA-1 is no longer considered secure against well-funded opponents". AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Given the reported 5%+ of Chinese browsers not supporting newer certs, I can see why customers might want a cert that gives them a lot more than nothing, though less than best-of-breed. It's the one-size-fits-all where someone's personal blog needs to have the same level of security as the apple app store's payment system that leaves them filling a real market need. They didn't go seeking people wanting SHA1 certs, people wanting SHA1 certs that would still work went seeking someone who would provide them. And they went seeking because the alternative is upgrading potentially millions of dollars worth of embedded kit which doesn't support newer certs, all to secure one link in a chain in which SHA1 is nowhere near the weakest link. So yeah, the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded in order to push a more secure ecosystem on everybody. Which is great from some perspectives, but it's environmental vandalism from another perspective, and if it pushes people back to non-HTTPS traffic for those older pieces of equipment it could cause a short term worsening of security. (the deprecation of sha1 that is. The lying by WoSign/StartCom was a calculated risk in a business where everything is based on trust, and they lost)

takluyver 10y ago
> I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem. > someone's personal blog needs to have the same level of security as the apple app store's payment system Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception. It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so. > the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.

ara24 10y ago

Is there a governing body or regulatory authority which looks over the process followed by CAs ? As a fan of firefox, I am happy that as a community, Mozilla has done the necessary ground work to reach this conclusion. However, as long as PKI remains a highly profitable business, more and more such events are going to happen. I don't think all CAs should be trusted equally. Right now, AFAIK, my browsing experience is only as secure as the weakest CA. Hopefully, HPKP can put an end to this.

lionradio 10y ago

I think Mozilla is falling for Symantecs / other CAs propaganda here. Yes, WoSign did bad things, but those are by far not the worst things we've seen in CA wrongdoings in the last years. We've seen certs issued for MITM attacks and security holes in the validation process of nearly every CA. (http://www.theregister.co.uk/2012/02/14/trustwave_analysis/ http://www.theregister.co.uk/2012/02/14/trustwave_analysis/) < they confessed issuing a cert for MITM purpose and are still part of the game. The allegations mainly consist of: a) WoSign didn't make transparent that they have control over StartCom. Yes, this is a thing and it should be discussed. But the main focus of this is obviously to get StartCom into this story. Where - as I understood it - there is no allegation, that StartCom itself did something wrong. At least not in the league of "we should kill that company". Transparency is important and we should fight for it. Not only in China. b) They backdated SHA-1 certs. Obviously because not updated Windows XP machines are a thing in China. This is against code of conduct. This is bad, but I totally get the intention here. And the intention is not MITM attacks or worse (as we see a lot in CA business) the intention is not to break Chinese internet. Bottom line: "Let's encrypt" is destroying the business of many shady CAs these days. Competition is getting harder. StartCom had an advance in this race as they adopted quickly to the new rules and the've build the best product in the market for special use cases. We - for example - rely on a lot of wildcard certs for many domains. StartCom had the product. We pay'd them $200 for all our certs and the next cheapest competitor wanted $150.000 / year for our certs. I totally get why they are getting attacked by the big players. I totally don't get why Mozilla is falling for this.

pfg 10y ago
There were a number of other issues that came up during this investigation that showed that they should not be running a CA[1]. For example, they issued certificates to anyone able to control a unprivileged port (> 1024) behind a domain. They issued certificates for "root domains" to anyone able to verify control of a subdomain. When StartCom launched their issuance API, it was taken down within a matter of days due to some pretty obvious holes. The biggest problem with the SHA-1 issuance is that they - as the report shows - blatantly lied about how this played out during the investigation and did not even attempt to go through the proper channels to get an exception from browser vendors (which other CAs did). Additionally, issuing a SHA-1 certificate to a payment processor that failed to upgrade their systems in time cannot be explained by China having a large number of XP <= SP2 users. That's just an excuse. Regarding the TrustWave incident a few years back, it's important to understand that this happened when the rules for CAs were not quite as clear as they are now. I think this happened just around the time when the Baseline Requirements were written and were not yet in effect, and various browser policies were not as clear as they could've been about this use-case. Four years later, I have no doubts that a CA who'd give out the private key of a non-constrained CA certificate to a non-audited third-party would lose their trust status within a matter of days. [1]: https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues

jhorna003 10y ago

If you have a small budget but do not want to miss out on the excitement of a Galapagos Islands cruisehttps://www.galapagosdanatours.com/galapagos-cruises/ https://www.galapagosdanatours.com/galapagos-cruises/ the tourist class might be right for you.