6 ms·

Despite revoked CA’s, StartCom and WoSign continue to sell certificates

83 points by tombrossman 10y ago

tombrossman 10y ago
I think we can expect to see more questions like this on StackExchange in the near future: http://webmasters.stackexchange.com/questions/103405/installing-startssl-certificate-under-apache-gives-sec-error-revoked-certificate http://webmasters.stackexchange.com/questions/103405/install...
- drvdevd 10y ago
  Disgusting.
- cptskippy 10y ago
  Looks like all the browsers need to do a better job communicating that error. Firefox and Safari are the only two that provide any clue as to the problem, however Safari seems to jump to conclusions a bit.
ealexhudson 10y ago
Unfortunately, StartSSL appear to be claiming that the SSL certificates themselves are free, and that they are only charging for the validation process - and while validation is potentially valuable, if you are unable to issue an SSL certificate that can make use of it, it seems limited. To say this is "shady practice" is putting it nicely; I daresay few but the keenest observers would pick up the problem.
- justinclift 10y ago
  Well, the "we charge for the validation, not the certificates" approach is how they've done things for ages. Prior to the clusterfk of becoming untrusted by Mozilla (etc), it was really useful. Once verified you could generate many certificates (subdomains, etc) without forking over cash each time. Compared to the general (scam-like?) model of other providers, it seems like a sane alternative. Now they're untrusted though, it's kind of moot. :(
- happywolf 10y ago
  Maybe a bit off-topic, I encountered a pretty rude experience with StartSSL's free certificate validation process and from then on I would rather pay some money to other vendors than getting a free cert from StartSSL. But I have been using Let's Encrypt which is pretty automated, and did I say it is totally free? Awesome is a word I will describe this kick-ass product.
Mojah 10y ago
Author of the article here: I learned in the meanwhile that the situation is less bad than it sounds. It's not a link-bait article, but keep in mind that they now resell other CA's certificates, they're not selling their own anymore. There will however be a brief period where they did sell their own certificates, signed by their own CA, that are now being blocked.
- willvarfar 10y ago
  Should we trust them as a reseller? If/when they mess up again, are they nearly so easy to revoke? Does the cert contain their name still?
  - kijin 10y ago
    As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.
  - ChefDenominator 10y ago
    I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.
  - vtlynch 10y ago
    Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.
omash 10y ago
Google can use its monopoly to accomplish almost anything!
- vurpo 10y ago
  All major browser vendors, not just Google, distrusted WoSign and StartCom. And it was for a good reason, not just because.
- ChefDenominator 10y ago
  My understanding is the issue with WoSign and discovery of their purchase of StartCom (which violated trusted CA process by not informing anyone that they were sold) was originally done by Mozilla, which was also the first to act to remove them from trust stores. https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
y04nn 10y ago
Is this why I had problems with my new free certificate from StartSSL about 2 weeks ago? It wasn't obvious, I ended up using Let's Encrypt.
vog 10y ago
This is the ideal time to switch to Let's Encrypt, and be done with certificate issues once and for all. https://letsencrypt.org/ https://letsencrypt.org/ https://certbot.eff.org/ https://certbot.eff.org/ You no longer have to ask year after year for a new certificate. It will be renewed automatically for as long as your webserver lives. And everything is backed by good protocols, a strong community and a trustworthy organization (EFF).
- Someone1234 10y ago
  > You no longer have to ask year after year for a new certificate. Now you have to ask every three months.
  - Ajedi32 10y ago
    Not if you can use certbot. Once you set it up your web server will periodically ask for a new cert, get one, and install it automatically, with no interaction required on your part.
  - cryptarch 10y ago
    Which is intended as an incentive to automate the process, for which there are a bunch of great tools available. It improves security at the small cost of having to slightly improve your deployment process.
  - vog 10y ago
    > Now you have to ask every three months. No, you have a script running that updates your certificate automatically, and you never ever have do that that manually again. Or, you don't need that script because your webserver (e.g. Caddy) does that for you. Oh, and just in case one of the intermediate certificates of Let's Encrypt had to be revoked for some reason: The very same mechanism would provide you with a new, working certificate as soon as possible. This, again, is fully automatic without any headache on your side. Do you know any other CA where get this level of comfort?
    - OrdaGarb 10y ago
beatle_sauce 10y ago
Did anybody notice that the Opera browser company and Wosign are both owned by Qihoo? https://en.wikipedia.org/wiki/Qihoo_360 https://en.wikipedia.org/wiki/Qihoo_360 What is the status of Wosign/Startcom certificates in the Opera browser? And in the Qihoo ("360 secure") browser?

83 points by tombrossman 10y ago

I think we can expect to see more questions like this on StackExchange in the near future: http://webmasters.stackexchange.com/questions/103405/installing-startssl-certificate-under-apache-gives-sec-error-revoked-certificate http://webmasters.stackexchange.com/questions/103405/install...

drvdevd 10y ago
Disgusting.
cptskippy 10y ago
Looks like all the browsers need to do a better job communicating that error. Firefox and Safari are the only two that provide any clue as to the problem, however Safari seems to jump to conclusions a bit.

ealexhudson 10y ago

Unfortunately, StartSSL appear to be claiming that the SSL certificates themselves are free, and that they are only charging for the validation process - and while validation is potentially valuable, if you are unable to issue an SSL certificate that can make use of it, it seems limited. To say this is "shady practice" is putting it nicely; I daresay few but the keenest observers would pick up the problem.

justinclift 10y ago
Well, the "we charge for the validation, not the certificates" approach is how they've done things for ages. Prior to the clusterfk of becoming untrusted by Mozilla (etc), it was really useful. Once verified you could generate many certificates (subdomains, etc) without forking over cash each time. Compared to the general (scam-like?) model of other providers, it seems like a sane alternative. Now they're untrusted though, it's kind of moot. :(
happywolf 10y ago
Maybe a bit off-topic, I encountered a pretty rude experience with StartSSL's free certificate validation process and from then on I would rather pay some money to other vendors than getting a free cert from StartSSL. But I have been using Let's Encrypt which is pretty automated, and did I say it is totally free? Awesome is a word I will describe this kick-ass product.

Mojah 10y ago

Author of the article here: I learned in the meanwhile that the situation is less bad than it sounds. It's not a link-bait article, but keep in mind that they now resell other CA's certificates, they're not selling their own anymore. There will however be a brief period where they did sell their own certificates, signed by their own CA, that are now being blocked.

willvarfar 10y ago
Should we trust them as a reseller? If/when they mess up again, are they nearly so easy to revoke? Does the cert contain their name still?
- kijin 10y ago
  As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.
- ChefDenominator 10y ago
  I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.
- vtlynch 10y ago
  Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.

omash 10y ago

Google can use its monopoly to accomplish almost anything!

vurpo 10y ago
All major browser vendors, not just Google, distrusted WoSign and StartCom. And it was for a good reason, not just because.
ChefDenominator 10y ago
My understanding is the issue with WoSign and discovery of their purchase of StartCom (which violated trusted CA process by not informing anyone that they were sold) was originally done by Mozilla, which was also the first to act to remove them from trust stores. https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...

y04nn 10y ago

Is this why I had problems with my new free certificate from StartSSL about 2 weeks ago? It wasn't obvious, I ended up using Let's Encrypt.

vog 10y ago

This is the ideal time to switch to Let's Encrypt, and be done with certificate issues once and for all. https://letsencrypt.org/ https://letsencrypt.org/ https://certbot.eff.org/ https://certbot.eff.org/ You no longer have to ask year after year for a new certificate. It will be renewed automatically for as long as your webserver lives. And everything is backed by good protocols, a strong community and a trustworthy organization (EFF).

Someone1234 10y ago
> You no longer have to ask year after year for a new certificate. Now you have to ask every three months.
- Ajedi32 10y ago
  Not if you can use certbot. Once you set it up your web server will periodically ask for a new cert, get one, and install it automatically, with no interaction required on your part.
- cryptarch 10y ago
  Which is intended as an incentive to automate the process, for which there are a bunch of great tools available. It improves security at the small cost of having to slightly improve your deployment process.
- vog 10y ago
  > Now you have to ask every three months. No, you have a script running that updates your certificate automatically, and you never ever have do that that manually again. Or, you don't need that script because your webserver (e.g. Caddy) does that for you. Oh, and just in case one of the intermediate certificates of Let's Encrypt had to be revoked for some reason: The very same mechanism would provide you with a new, working certificate as soon as possible. This, again, is fully automatic without any headache on your side. Do you know any other CA where get this level of comfort?
  - OrdaGarb 10y ago

beatle_sauce 10y ago

Did anybody notice that the Opera browser company and Wosign are both owned by Qihoo? https://en.wikipedia.org/wiki/Qihoo_360 https://en.wikipedia.org/wiki/Qihoo_360 What is the status of Wosign/Startcom certificates in the Opera browser? And in the Qihoo ("360 secure") browser?