11 ms·
DigiCert to Acquire Symantec’s Website Security and Related PKI Solutions
- pastyboy 9y agoEh ? About to be untrusted by google... interesting time to sell it.
- geofft 9y agoIt's Symantec's past operation of the CA that's untrusted by Google, and in fact one of the proposals was that Symantec make a new CA and cross-sign it with their old one, which would maintain compatibility for previous customers that pinned the Symantec root as well as customers using up-to-date browsers. So if the setup here is that DigiCert signs their own CA with Symantec's, then everyone's happy: DigiCert gets the customers, the community believes DigiCert is competent, and old Symantec customers get business continuity. It possibly makes more business sense for Symantec to sell their root to a trusted CA than to continue to operate it. And I think it makes sense for DigiCert to buy it: Symantec's customers are people who are clearly willing to pay too much for even a low-quality certificate because they let Symantec consultants set up their trust infrastructure years ago and have no idea how to modernize their infrastructure. If you want a target market of people who will pay lots of money for CA services despite the presence of free services like Let's Encrypt, Symantec's existing customer base is a perfect fit.
- toomuchtodo 9y agoI work in the financial infrastructure space, and while I'm no fan of Symantec, using Let's Encrypt would get me laughed out of the room by compliance and our auditors. Some checkboxes are ceremony, some have real purpose. One size does not fit all.
- colinbartlett 9y agoWhat about Let's Encrypt certificates make them non compliant to your auditors?
- tptacek 9y agoThe checkboxes you're implicating here are the ceremonial kind. (I do security in the financial infrastructure space, for whatever that's worth).
- toomuchtodo 9y agoI suppose we'll agree to disagree (RegSCI in this case). Happy to grab a beer if you want to lecture me on how I'm wrong, I try to be open minded. Whether it's ceremony or not, I have to check the box or face harsh regulatory penalties.
- tptacek 9y ago
- tortasaur 9y agoInteresting time to buy it, I'd say.
- tedivm 9y agoAs I mentioned above, when Symantec bought Verisign it was making over $440 million a year in profit (not revenue, profit). Buying up their customers like this is huge for Digicert. They're getting a huge influx of paying customers at a steep discount. I'd expect Digicert to make billions off of this deal over the next decade.
- mw6621 9y ago"Under the terms of the agreement, Symantec will receive approximately $950 million in upfront cash proceeds and approximately a 30 percent stake in the common stock equity of the DigiCert business at the closing of the transaction."
- michaelbuckbee 9y agoI'm a reseller for Digicert - they just sent an announcement email about this, here's the most interesting bit: "Earlier this year, the browsers proposed a plan to limit trust in Symantec certificates after discovering issues with how they were validating and issuing digital certificates. Importantly, we feel confident that this agreement will satisfy the needs of the browser community. DigiCert is communicating this deal and its intentions to the browser community and will continue to work closely with them during the period leading up to our closing the transaction. DigiCert appreciates and shares the browsers’ commitment to engendering trust in digital certificates and protecting all users. "
- justinjlynn 9y agoYou may want to come up with an escape plan then. If digicert can buy Symantec so that Symantec can escape censure what message does that send? At this point Symantec should be considered so radioactive that nobody would go near it for fear of contamination. Symantec betrayed all of us and digicert, in buying it and rewarding the behaviour is doing the same.
- cjbprime 9y agoThe message is that Symantec doesn't get to run a CA business anymore. Presumably the fact that a sale was somewhat necessary was priced into the purchase price.
- justinjlynn 9y agoThe point is the purchase price should have been zero. I want every Symantec shareholder to feel the pain and never invest in any company that is that shit again.
- thanksgiving 9y agoThey will own 30%of digicert. I think this deal should put digicert on a "one strike and you're out" zone as well. I don't understand what's going on. Digicert will give Symantec 800M+ cash and a 30% equity? And Symantec will generously allow the current digicert CEO to continue as the CEO of digicert? Doesn't look like Symantec is selling anything. Looks like Symantec is buying digicert from the owners of digicert.
- rietta 9y agoHow is Symantec's cert business not a toxic asset given their historical practices?
- toast0 9y agoI don't recall the exact details of their poor historical practices, but I think they at least had audited issuance, and reasonable control of their roots, although their intermediates issued questionable certificates? If so, the new owner can relatively easily shut down issuance under the current pipelines of questionable quality; issue new intermediates from the root, to be used in the new owner's pipelines and to make it possible to revoke/detrust the old intermediates if more serious trust issues are uncovered in the previous practices. Then the new owner gets to enjoy the benefits of the previous customer base, and installed base of the roots and pins. In short, as long as they do a good job of making a clean separation of issuing practices, it's not a toxic asset.
- apecat 9y agoWell this business unit might be a toxic asset now. But I'm sure it'll go right back to printing money once it's no longer directly associated with a vendor of TLS interception middle boxes popular among despots. And the browser relations fiasco will blow over eventually. Might cost them a bunch of rebates and refunds to keep clients, but I see why this could be a viable customer acquisition move for DigiCert.
- deleted 9y ago[deleted]
- geofft 9y agoOh, it's almost certainly a toxic asset. But have you seen the blog post where Symantec was like "We talked to our customers and they said that Google's being mean"? https://www.symantec.com/connect/blogs/symantec-ca-proposal https://www.symantec.com/connect/blogs/symantec-ca-proposal > Many large organizations have complex, and potentially undocumented and little-known dependencies on their certificate infrastructure. Examples of complex dependencies on Symantec public roots that our customers have shared or we have identified include: > Embedded devices that are pinned to certificates issued by a Symantec public root to communicate to resources over the Internet or Intranet. Replacing these certificates would result in immediate failures and the need to recode and reimage the firmware for these devices. > Mobile applications that have pinned certificates. Replacing server certificates would require these applications to be recoded, recompiled and redistributed. > Critical infrastructure organizations that use certificates issued off of Symantec roots to validate internal and external resources. In many cases, the applications being used are pinned to Symantec certificates. > Some large organizations use certificates chained to Symantec public roots for nearly all internal applications and communications. Many of these organizations are under regulatory requirements to encrypt even internal communications. You have lots of customers that have made the stupid decision to hard-code the Symantec public key as indefinitely trustworthy. (Some of them may well have got Symantec to do the consulting for their internal infrastructure.) No matter how stupid the decision is, it's been made, and those customers will pay good money for a cert that's either issued directly from or chains to the Symantec root. Even if the only thing that DigiCert does with the Symantec private key is to sign their own CA and then destroy it, and they kill the Symantec brand and every piece of Symantec infrastructure, that still brings them tons of customers who literally cannot move to a competitor not in possession of the Symantec private key. I'm not surprised that's worth $1B.
- huhtenberg 9y agoFrom the email announcement: ... snip ... Also, some of you may be wondering about any implications our announced acquisition will have on the ongoing debate between Symantec and the browser community about trust in their certificates. Earlier this year, the browsers proposed a plan to limit trust in Symantec certificates after discovering issues with how they were validating and issuing digital certificates. Importantly, we feel confident that this agreement will satisfy the needs of the browser community. DigiCert is communicating this deal and its intentions to the browser community and will continue to work closely with them during the period leading up to our closing the transaction. DigiCert appreciates and shares the browsers’ commitment to engendering trust in digital certificates and protecting all users. ... snip ...
- packetized 9y agoMake no mistake, this is going to be an even greater period of uncertainty for current SYMC CA customers over the next six to twelve months.
- tptacek 9y agoPresumably the idea here is that DigiCert is buying Symantec's customer database, and instead of Symantec painstakingly transferring its users to a new, trustworthy certificate issuance system, everyone will just use DigiCert's. Which, if that's the case, will mean Google and Mozilla more or less killed the web's largest CA.
- justinjlynn 9y ago> Which, if that's the case, will mean Google and Mozilla more or less killed the web's largest CA. No, no it did not. Symantec deserve zero benefit for any "customer base" transfer and digicert should be ashamed for rewarding Symantec's behaviour. What Symantec did should result in punishment so severe no CA would dare do the same ever again. Their business should be null and void and considered to be worth absolutely nothing.
- CaveTech 9y agoYou seem to be conflating expectations and reality. They did kill the business, but Symantec was able to salvage part of it.
- justinjlynn 9y agoThey should have been utterly destroyed; not parted out to the highest bidder. I want every Symantec shareholder to feel the pain of a zero share price for what they enabled.
- tptacek 9y agoWhere once there was a Symantec CA system, now there is none. It is dead. It wasn't dead before. The thing that made it be dead? Google. I think you're mostly arguing with claims I didn't make.
- justinjlynn 9y agoThe point I'm trying to make is that they're not dead if they own 30% of digicert as a result of this instead of being left with nothing.
- yuhong 9y agoIn any case, I wonder if Google "senior executives" are really involved.