3 ms·

Should we trust them as a reseller? If/when they mess up again, are they nearly so easy to revoke? Does the cert contain their name still?

kijin 10y ago
As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.
ChefDenominator 10y ago
I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.
vtlynch 10y ago
Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.

kijin 10y ago

As far as I'm aware of, validation is performed by the original CA even if you buy the certificate from a reseller. But I've only bought certs from a handful of resellers, so maybe there are other ways for resellers to integrate with a CA's system. StartSSL's unusual pricing scheme (validate once, get unlimited certs for a year) makes me a bit suspicious in this regard.

ChefDenominator 10y ago

I think it goes beyond just trust - they have violated the intent of the concept of trust. The nature of their behavior appears to be malicious. Beyond just not trusting them, they should be ostracized.

vtlynch 10y ago

Certificate resellers are only taking money in exchange for the cert. They are not doing any validation. This is true even in cases like Gandi.net where some of the certs they sell come from a custom-branded intermediate certificate. The root CA is Comodo and they are doing the validation, controlling the private key's of the certs that handle issuance, etc. Its just a branding thing. There are a few cases with Sub-CAs/Registration Authorities where a third-party company is handling some/all of the certificate validation. Symantec is currently in trouble for the bad actions of CrossCert, a Korean company that was licensed to be a Sub-CA. But WoSign/StartCom would not be able to participate in any sort of arrangement like this without being immediately banned again. So there is no inherent problem with a banned CA continuing to sell certificates that another CA is validating. However, in the investigation of WoSign it was found that the company is deeply dishonest, incompetent, and even a little bit malicious. So anything that puts money in their pocket should be avoided.