4 ms·

It sounds like Trustico got these certificates from Symantec. The CEO of Trustico was arguing that they should be revoked as they weren't secure and emailed the

It sounds like Trustico got these certificates from Symantec. The CEO of Trustico was arguing that they should be revoked as they weren't secure and emailed the private keys as proof. Which, while a dumb thing to do, did prove his point I guess. EDIT: From Trustico's account > We believe the orders placed via our Symantec account were at risk and were poorly managed. We have been questioning Symantec without response as to concerning items for about a year. Symantec simply ignored our concerns and appeared to bury them under the next issue that arose... We were also a victim whereby Symantec mis-issued SSL Certificates owned by us, subsequently we were asked to keep the matter quiet, under a confidentially notice. https://groups.google.com/d/msg/mozilla.dev.security.policy/wxX4Yv0E3Mk/jx6r9jlPAwAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/...

Ajedi32 9y ago
Why would they not try to transition their customers to new certs _before_ getting all the old certs revoked though? Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.
- dpark 9y ago
  Because of utter incompetence.
- majewsky 9y ago
  We're using the Symantec/Digicert API for getting certs at work. I'm not directly involved in that, but I think when you want to issue a new cert you have to revoke the old one first. The API will just return an error if there is an existing cert for the same domain name. I recall vividly that when we moved from manually-issued certs (using their website) to automatic issuing (using their API), we had to revoke all certs before starting the automatic job for the first time. I don't know how it works wrt moving from the old Symantec root to the new Digicert root; I'm not directly involved in that. Oh, and BTW, of course we're investigating moving to Let's Encrypt instead, if only because we can use an existing ACME client and don't have to continue maintaining our own certificate automation.
  - Piskvorrr 9y ago
    That doesn't make sense. Old cert expires 2018-03-01 23:59:59, yet I'm not even allowed to apply for a new one valid from 2018-03-02 00:00:00?
    - majewsky 9y ago
      You can get a new cert when the existing one has less than one month remaining lifetime. The problem is that Chrome now distrusts Symantec certs way before their expiration date.
      - Piskvorrr 9y ago
        Ah, now it makes sense.
  - cortesoft 9y ago
    That makes no sense; how would you extend a cert at the end of its life? If you have to revoke one to get a new one, that means you will have to take an outage, since you will need to get the new cert and install it after revoking the old one.
  - fgonzag 9y ago
    I use digicert and I can get as many certificates as I want with my wildcard cert. In fact I run different certificates in different contexts.
  - benmmurphy 9y ago
    we were using symtantec. then when they cocked it up we switched to the amazon ACM which integrates with our infrastructure and doesn't have dodgy people running it. and is 'free'. but not really because it is hidden cost of our AWS pricing.

Ajedi32 9y ago

Why would they not try to transition their customers to new certs _before_ getting all the old certs revoked though? Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.

dpark 9y ago
Because of utter incompetence.
majewsky 9y ago
We're using the Symantec/Digicert API for getting certs at work. I'm not directly involved in that, but I think when you want to issue a new cert you have to revoke the old one first. The API will just return an error if there is an existing cert for the same domain name. I recall vividly that when we moved from manually-issued certs (using their website) to automatic issuing (using their API), we had to revoke all certs before starting the automatic job for the first time. I don't know how it works wrt moving from the old Symantec root to the new Digicert root; I'm not directly involved in that. Oh, and BTW, of course we're investigating moving to Let's Encrypt instead, if only because we can use an existing ACME client and don't have to continue maintaining our own certificate automation.
- Piskvorrr 9y ago
  That doesn't make sense. Old cert expires 2018-03-01 23:59:59, yet I'm not even allowed to apply for a new one valid from 2018-03-02 00:00:00?
  - majewsky 9y ago
    You can get a new cert when the existing one has less than one month remaining lifetime. The problem is that Chrome now distrusts Symantec certs way before their expiration date.
    - Piskvorrr 9y ago
      Ah, now it makes sense.
- cortesoft 9y ago
  That makes no sense; how would you extend a cert at the end of its life? If you have to revoke one to get a new one, that means you will have to take an outage, since you will need to get the new cert and install it after revoking the old one.
- fgonzag 9y ago
  I use digicert and I can get as many certificates as I want with my wildcard cert. In fact I run different certificates in different contexts.
- benmmurphy 9y ago
  we were using symtantec. then when they cocked it up we switched to the amazon ACM which integrates with our infrastructure and doesn't have dodgy people running it. and is 'free'. but not really because it is hidden cost of our AWS pricing.