3 ms·
They bring that up in the document: > It is true that this date is chosen by the CA and therefore WoSign/StartCom could back-date certificates to get around th
by karlshea 10y ago
They bring that up in the document:
> It is true that this date is chosen by the CA and therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the Web PKI and if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
- rspeer 10y agoWhich means it's important that they try really hard to avoid being detected. They probably can't do it, but it's still got a better chance of success for them than staying in business for a year with no sales. ---- Edit: When I think a moment more about it, my point is silly. I realize how inconceivably impossible it is for them to avoid detection. If they sell backdated certs, one easy way to detect this would be to buy one.