3 ms·

Apparently, they also sent out an e-mail with the same text to their customers, with an addendum that they are going to try to get a certificate for each custom

by pferde 9y ago

Apparently, they also sent out an e-mail with the same text to their customers, with an addendum that they are going to try to get a certificate for each customer with other CAs, and that to opt-out, one has to send them an e-mail. I found that addendum quite strange. Such thing should be opt-in, in my opinion.

jstanley 9y ago
Text of the email is here: https://pastebin.com/6BCCFtJx https://pastebin.com/6BCCFtJx
cdancette 9y ago
I received the email, and I agree, I thought "Just leave me and my certificates alone would you?" They did enough damage already
ahoka 9y ago
Maybe you get a shiny new Turk Trust cert in exchange. Who knows.
- therein 9y ago
  Why Turk Trust?
  - delta1 9y ago
    ... basically the top google search result https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
- stryk 9y ago
  I have no idea if 'Turk Trust' is even a real CA or if you made up the name in jest. I'm honestly scared to Google it and find out, in slight fear of finding out that is an actual CA. (Not to get too political here, but given Turkey's current government, I'm not sure how anyone in their right mind would 1- trust them to say or do _anything_, and 2- trust SSL encryption certs coming out of there)
  - Shoothe 9y ago
    At least it's not Honest Achmed's Used Cars and Certificates ;) https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
    - Macha 9y ago
      Interestingly: > Eddy Nigg (StartCom) > Comment 11 • 7 years ago > According to http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ and https://wiki.mozilla.org/CA:Information_checklist https://wiki.mozilla.org/CA:Information_checklist apparently fails to comply to the audit requirements amongst other things at the moment. Should a valid audit statement be published and confirmed by an authorized auditor, I guess Mozilla could consider a discussion to include this CA.
    - NetOpWibby 9y ago
      LMAO
  - jwilk 9y ago
    It's real: https://bugzilla.mozilla.org/show_bug.cgi?id=1007683 https://bugzilla.mozilla.org/show_bug.cgi?id=1007683
  - nurettin 9y ago
    I'm Turkish and I agree. Also, Turk trust got involved in a controversy where they admitted that they leaked a private key. https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/amp/ https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/201...
mike-cardwell 9y ago
Probably just a roundabout way to say that they're selling their customer data and you have to contact them to opt out.
Matt3o12_ 9y ago
Thank you very much for pointing out about the opt-out crap. I also got the email but I didn’t bother to read past the first paragraph because I stopped using them as soon as I switched to cloudlfare for my certificates. I always hated their interface but as a broke high school student I couldn’t afford to have a paid certificate. Thankfully we have Let’s Encrypt now
- Matt3o12_ 9y ago
  I have received a follow up email by them in a very timely manner: > Hi, > > Sure, we will record your user ID and your details won't be transferred to other CA, as the alternative CA option is for those who need it. > > Best regards, > StartCom Certification > Authority
nvr219 9y ago
I got the email. Here is the full text: This is an automatically generated email, please do not reply. Dear customer, As you are surely aware, the browser makers distrusted StartCom around a year ago and therefore all the end entity certificates newly issued by StartCom are not trusted by default in browsers. The browsers imposed some conditions in order for the certificates to be re-accepted. While StartCom believes that these conditions have been met, it appears there are still certain difficulties forthcoming. Considering this situation, the owners of StartCom have decided to terminate the company as a Certification Authority as mentioned in StartcomÂ´s website. StartCom will stop issuing new certificates starting from January 1st, 2018 and will provide only CRL and OCSP services for two more years. StartCom would like to thank you for your support during this difficult time. StartCom is contacting some other CAs to provide you with the certificates needed. In case you donÂ´t want us to provide you an alternative, please, contact us at certmaster@startcomca.com Please let us know if you need any further assistance with the transition process. We deeply apologize for any inconveniences that this may cause. Best regards, StartCom Certification Authority
- justinjlynn 9y ago
  Amusing that they couldn't get the encoding correct on their final email either.
  - nneonneo 9y ago
    It’s correct in the email I received. It’s a non-ascii apostrophe so I guess certain mail clients might not handle it correctly?
    - nvr219 9y ago
      I copied and pasted from Outlook... probably Outlook's fault honestly.
  - LukeShu 9y ago
    In the email I received, it's a non-ASCII apostrophe encoded in UTF-8. The email headers say "Content-Type: text/html; charset=iso-8859-1", but then the HTML body says "<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>". Clients that give preference to the header will get it wrong. The full raw email: https://lukeshu.com/dump/startcom-email.txt https://lukeshu.com/dump/startcom-email.txt

by pferde 9y ago

jstanley 9y ago

Text of the email is here: https://pastebin.com/6BCCFtJx https://pastebin.com/6BCCFtJx

cdancette 9y ago

I received the email, and I agree, I thought "Just leave me and my certificates alone would you?" They did enough damage already

ahoka 9y ago

Maybe you get a shiny new Turk Trust cert in exchange. Who knows.

therein 9y ago
Why Turk Trust?
- delta1 9y ago
  ... basically the top google search result https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
stryk 9y ago
I have no idea if 'Turk Trust' is even a real CA or if you made up the name in jest. I'm honestly scared to Google it and find out, in slight fear of finding out that is an actual CA. (Not to get too political here, but given Turkey's current government, I'm not sure how anyone in their right mind would 1- trust them to say or do _anything_, and 2- trust SSL encryption certs coming out of there)
- Shoothe 9y ago
  At least it's not Honest Achmed's Used Cars and Certificates ;) https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
  - Macha 9y ago
    Interestingly: > Eddy Nigg (StartCom) > Comment 11 • 7 years ago > According to http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ and https://wiki.mozilla.org/CA:Information_checklist https://wiki.mozilla.org/CA:Information_checklist apparently fails to comply to the audit requirements amongst other things at the moment. Should a valid audit statement be published and confirmed by an authorized auditor, I guess Mozilla could consider a discussion to include this CA.
  - NetOpWibby 9y ago
    LMAO
- jwilk 9y ago
  It's real: https://bugzilla.mozilla.org/show_bug.cgi?id=1007683 https://bugzilla.mozilla.org/show_bug.cgi?id=1007683
- nurettin 9y ago
  I'm Turkish and I agree. Also, Turk trust got involved in a controversy where they admitted that they leaked a private key. https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/amp/ https://www.google.com.tr/amp/s/nakedsecurity.sophos.com/201...

mike-cardwell 9y ago

Probably just a roundabout way to say that they're selling their customer data and you have to contact them to opt out.

Matt3o12_ 9y ago

Thank you very much for pointing out about the opt-out crap. I also got the email but I didn’t bother to read past the first paragraph because I stopped using them as soon as I switched to cloudlfare for my certificates. I always hated their interface but as a broke high school student I couldn’t afford to have a paid certificate. Thankfully we have Let’s Encrypt now

Matt3o12_ 9y ago
I have received a follow up email by them in a very timely manner: > Hi, > > Sure, we will record your user ID and your details won't be transferred to other CA, as the alternative CA option is for those who need it. > > Best regards, > StartCom Certification > Authority

nvr219 9y ago

I got the email. Here is the full text: This is an automatically generated email, please do not reply. Dear customer, As you are surely aware, the browser makers distrusted StartCom around a year ago and therefore all the end entity certificates newly issued by StartCom are not trusted by default in browsers. The browsers imposed some conditions in order for the certificates to be re-accepted. While StartCom believes that these conditions have been met, it appears there are still certain difficulties forthcoming. Considering this situation, the owners of StartCom have decided to terminate the company as a Certification Authority as mentioned in StartcomÂ´s website. StartCom will stop issuing new certificates starting from January 1st, 2018 and will provide only CRL and OCSP services for two more years. StartCom would like to thank you for your support during this difficult time. StartCom is contacting some other CAs to provide you with the certificates needed. In case you donÂ´t want us to provide you an alternative, please, contact us at certmaster@startcomca.com Please let us know if you need any further assistance with the transition process. We deeply apologize for any inconveniences that this may cause. Best regards, StartCom Certification Authority

justinjlynn 9y ago
Amusing that they couldn't get the encoding correct on their final email either.
- nneonneo 9y ago
  It’s correct in the email I received. It’s a non-ascii apostrophe so I guess certain mail clients might not handle it correctly?
  - nvr219 9y ago
    I copied and pasted from Outlook... probably Outlook's fault honestly.
- LukeShu 9y ago
  In the email I received, it's a non-ASCII apostrophe encoded in UTF-8. The email headers say "Content-Type: text/html; charset=iso-8859-1", but then the HTML body says "<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>". Clients that give preference to the header will get it wrong. The full raw email: https://lukeshu.com/dump/startcom-email.txt https://lukeshu.com/dump/startcom-email.txt