3 ms·

Existing certs (those with a notBefore date before Oct 21 [0]) are still trusted by Firefox. New certificates are not. (WoSign could theoretically backdate the

Existing certs (those with a notBefore date before Oct 21 [0]) are still trusted by Firefox. New certificates are not. (WoSign could theoretically backdate the notBefore date on new certs to make them look like existing certs, but Mozilla have said that if they catch WoSign doing this they'll distrust their root totally.) Other browsers are taking similar measures, but I'm not sure on the details. [0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...

Crosseye_Jack 10y ago
Apple are trusting certs WoSign published to Certifitcate transparency server before September [0] and StartCom certs with an notbefore dates of December [1] [0] https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/lWJ1zdUJPLI https://groups.google.com/forum/m/#!topic/mozilla.dev.securi... [1] https://groups.google.com/forum/m/#!topic/mozilla.dev.security.policy/EqkAdP4nQ_s https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...