5 ms·

A 1 year suspension and continued trust of previously signed certificates? Sounds very generous to me.

geofft 10y ago
It's generous to the customers who currently have existing, valid WoSign or StartCom certificates. It's not very generous to WoSign or StartCom as continuing profitable businesses, because if I were paying either of these companies for certificates, I'd be looking for someone else to pay when it comes time to renew. This is exactly what you want.
throwawayReply 10y ago
With a "play by the rules or you're out" attached. It's more lenient than some might want, but it avoids the decision being controversial and perhaps lessens the chance that it is seriously challenged.
TorKlingberg 10y ago
It's not a 1 year suspension. It's a 1 year complete ban, then they may apply again from scratch, with extra requirements.
tptacek 10y ago
How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor (raises hand! pick me!) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear. StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue. You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.
- bcg1 10y ago
  Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.
  - tptacek 10y ago
    It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.
    - jvehent 10y ago
      Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA. That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.
    - xnyhps 10y ago
      Or buy yet another CA and continue under their name?
    - x0x0 10y ago
      There should be a 1-year plus ban on principals as well.
- bandrami 10y ago
  Yeah but the existing certs are still out there. While it's great that a company is being punished, this completely ignores the fact that we have no idea what they've signed, and short of laboriously checking the trust path of every single certificate you encounter there's no way to know if the cert you're looking at at any given moment came from them or not. And worse yet, the bigger problem is there's not a practical way to actually yank all of the certificates they signed that will work for arbitrary clients who don't know anything about this process to begin with and just look for a lock in the address bar, if that.
gregmac 10y ago
With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [..] Our proposal is that we determine “newly issued” by examining the notBefore date [...] therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
jerf 10y ago
To the other observations, I'd also observe that in a world of corporate entities, there isn't a meaningful way to permanently eliminate a CA. Bad actors can always dissolve the old entity, form a new one with the same policies and any of the same people you'd like, and do the same thing. Banning the existing corporation for a year is about all you can do; the more time that goes by the fuzzier it becomes as to what exactly that "entity" is. By far the more important element here is not that the specific corporate entity gets nuked, but that it be demonstrated to all and sundry that the CA standards have teeth. That is what will keep the bad actors from "just" doing anything to get around the problem, not psychologically-appealing vengeance.
oxguy3 10y ago
Given WoSign's history of backdating SHA-1 certificates in violation of Mozilla's rules, I wouldn't be too surprised if they reuse that practice to get around the 1 year ban, at which point Mozilla will have to consider permanently distrusting them.
- nandhp 10y ago
  They've already considered it and are including this in their proposal: > WoSign/StartCom could back-date certificates to get around this restriction. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
  - Paul-ish 10y ago
    Would they do this out of spite? StartCom is essentially done for and has little to lose, so out of bitterness they could try to turn their customers against the browser vendors.

It's generous to the customers who currently have existing, valid WoSign or StartCom certificates. It's not very generous to WoSign or StartCom as continuing profitable businesses, because if I were paying either of these companies for certificates, I'd be looking for someone else to pay when it comes time to renew. This is exactly what you want.

throwawayReply 10y ago

With a "play by the rules or you're out" attached. It's more lenient than some might want, but it avoids the decision being controversial and perhaps lessens the chance that it is seriously challenged.

TorKlingberg 10y ago

It's not a 1 year suspension. It's a 1 year complete ban, then they may apply again from scratch, with extra requirements.

tptacek 10y ago

How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor (raises hand! pick me!) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear. StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue. You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.

bcg1 10y ago
Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.
- tptacek 10y ago
  It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.
  - jvehent 10y ago
    Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA. That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.
  - xnyhps 10y ago
    Or buy yet another CA and continue under their name?
  - x0x0 10y ago
    There should be a 1-year plus ban on principals as well.
bandrami 10y ago
Yeah but the existing certs are still out there. While it's great that a company is being punished, this completely ignores the fact that we have no idea what they've signed, and short of laboriously checking the trust path of every single certificate you encounter there's no way to know if the cert you're looking at at any given moment came from them or not. And worse yet, the bigger problem is there's not a practical way to actually yank all of the certificates they signed that will work for arbitrary clients who don't know anything about this process to begin with and just look for a lock in the address bar, if that.

gregmac 10y ago

With a caveat, which sends a pretty strong and clear message: > We plan to distrust only newly-issued certificates to try and reduce the impact on web users [..] Our proposal is that we determine “newly issued” by examining the notBefore date [...] therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.

jerf 10y ago

To the other observations, I'd also observe that in a world of corporate entities, there isn't a meaningful way to permanently eliminate a CA. Bad actors can always dissolve the old entity, form a new one with the same policies and any of the same people you'd like, and do the same thing. Banning the existing corporation for a year is about all you can do; the more time that goes by the fuzzier it becomes as to what exactly that "entity" is. By far the more important element here is not that the specific corporate entity gets nuked, but that it be demonstrated to all and sundry that the CA standards have teeth. That is what will keep the bad actors from "just" doing anything to get around the problem, not psychologically-appealing vengeance.

oxguy3 10y ago

Given WoSign's history of backdating SHA-1 certificates in violation of Mozilla's rules, I wouldn't be too surprised if they reuse that practice to get around the 1 year ban, at which point Mozilla will have to consider permanently distrusting them.

nandhp 10y ago
They've already considered it and are including this in their proposal: > WoSign/StartCom could back-date certificates to get around this restriction. [...] if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
- Paul-ish 10y ago
  Would they do this out of spite? StartCom is essentially done for and has little to lose, so out of bitterness they could try to turn their customers against the browser vendors.