3 ms·
They're not "killing" anyone. They have reasonable doubt that the CA has misrepresented the truth and engaged in practices that violate the rules set forth by t
by daenney 10y ago
They're not "killing" anyone. They have reasonable doubt that the CA has misrepresented the truth and engaged in practices that violate the rules set forth by the CAB and those for inclusion in the Mozilla trust store. There will have to be consequences for else it means nothing.
They're also very clear that they do not intend to invalidate any already issued certificates, only new ones after a specific, yet to be decided, date and that they remain open to re-inclusion after the year's time-out and passing the normal inclusion tests. However, they rightfully set forth a requirement for some audits to take place by Mozilla appointed parties. For this I'm particularly thankful as if the auditors are allowed to keep doing this kind of hodge-bodge botch job the already strained trust in CA's is further weakened.
- ceejayoz 10y agoA one year timeout seems likely to tank their business. "We can't renew your cert, you'll have to go elsewhere" isn't great PR. That said, they deserve it.
- azernik 10y agoThey're absolutely killing WoSign/Startcom. It's totally justified, but it's what they're doing.
- r00fus 10y agoWoSign/Startcom signed their own "death warrant" by engaging in fraud. I only wish death sentences for companies participating in blatantly fraudulent activities would be issued more regularly by regulatory agencies.