3 ms·

Author of the article here: I learned in the meanwhile that the situation is less bad than it sounds. It's not a link-bait article, but keep in mind that they n

by Mojah 10y ago

Author of the article here: I learned in the meanwhile that the situation is less bad than it sounds. It's not a link-bait article, but keep in mind that they now resell other CA's certificates, they're not selling their own anymore. There will however be a brief period where they did sell their own certificates, signed by their own CA, that are now being blocked.

willvarfar 10y ago
Should we trust them as a reseller? If/when they mess up again, are they nearly so easy to revoke? Does the cert contain their name still?
- kijin 10y ago
  As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.
- ChefDenominator 10y ago
  I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.
- vtlynch 10y ago
  Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.
teddyh 10y ago
> It's not a link-bait article, but keep in mind that they now resell other CA's certificates, they're not selling their own anymore. Thank you for the information, but I disagree, this is exactly a link-bait article; the headline clearly implies that they are still selling their revoked certs.
- tinus_hn 10y ago
  Link-bait means the article was written with the intention of getting links. The author is the only person in the world who knows his own intention. You can't really argue him about that because you can't look inside his head and find out his intentions. He also offered an alternative explanation: the title was a mistake.

by Mojah 10y ago

willvarfar 10y ago

Should we trust them as a reseller? If/when they mess up again, are they nearly so easy to revoke? Does the cert contain their name still?

kijin 10y ago
As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.
ChefDenominator 10y ago
I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.
vtlynch 10y ago
Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.

teddyh 10y ago

> It's not a link-bait article, but keep in mind that they now resell other CA's certificates, they're not selling their own anymore. Thank you for the information, but I disagree, this is exactly a link-bait article; the headline clearly implies that they are still selling their revoked certs.

tinus_hn 10y ago
Link-bait means the article was written with the intention of getting links. The author is the only person in the world who knows his own intention. You can't really argue him about that because you can't look inside his head and find out his intentions. He also offered an alternative explanation: the title was a mistake.