5 ms·

Revocation for being three days late in implementing a new standard would be a massive overreaction. It would harm thousands of businesses in the process and wo

• wbl 9y ago
  Revocation can be done only for new certs. It's time to throw a CA to the dogs once in a while pour encourage les autres.
  • daenney 9y ago
    Not at all. Revoke trust in the signing authority and all it's certificates turn invalid the second that change hits. Update your OS's trust store to not trust Comodo anymore and you'll see the effects immediately in IE/Edge on Windows or Safari and Chrome on macOS (Firefox still ships its own CA bundle). It's just that when trust has been revoked in CAs recently, it's been done in a more gradual fashion to not hurt customers too much and give them time to migrate. After all, it's not the customer's fault the CA went rogue. This usually starts with not accepting certificates past a certain date but still validating previously issued ones, until sometime 6 months to a year later they're completely distrusted.
    • wbl 9y ago
      Which is exactly what I said above could be done.
      • daenney 9y ago
        That's not at all what you said. What I replied to is where you literally said: > Revocation can be done only for new certs. That's not true. The "newness" of a cert or a CA has absolutely nothing to do with how, if and when it can be revoked.
• tehlike 9y ago
  Comodo doesn't have good security practices, it looks like, from my recent memory (confirmed with some google searches as well).