3 ms·
Startcom's certs still show as ok in Firefox for me. Any idea when this kicks in?
by hackerboos 10y ago
Startcom's certs still show as ok in Firefox for me. Any idea when this kicks in?
- tptacek 10y agoNope; I'm sure the information is out there somewhere. There was a big discussion about grandfathering, too.
- duskwuff 10y agoThe Startcom revocation wasn't retroactive. It only affects certificates issued after 2016-10-21.
- mrgreenfur 10y agoThanks for adding this clarification!
- adambrenecki 10y agoExisting certs (those with a notBefore date before Oct 21 [0]) are still trusted by Firefox. New certificates are not. (WoSign could theoretically backdate the notBefore date on new certs to make them look like existing certs, but Mozilla have said that if they catch WoSign doing this they'll distrust their root totally.) Other browsers are taking similar measures, but I'm not sure on the details. [0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
- Crosseye_Jack 10y agoApple are trusting certs WoSign published to Certifitcate transparency server before September [0] and StartCom certs with an notbefore dates of December [1] [0] https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/lWJ1zdUJPLI https://groups.google.com/forum/m/#!topic/mozilla.dev.securi... [1] https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/EqkAdP4nQ_s https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...