3 ms·
Jesus. That means it's not just about "offering revocation" and storing them on the wrong side; even people who didn't use that option are completely compromise
by Bartweiss 9y ago
Jesus. That means it's not just about "offering revocation" and storing them on the wrong side; even people who didn't use that option are completely compromised.
- tialaramex 9y agoIf you generated your own Private Key and used that to make one or more CSRs, you can show any fool the CSR and no harm will come to you, at least on the cryptographic side. Upload it to 4chan, print it out on a T-shirt, doesn't matter. Any certificates produced are worthless to everybody except you, because you have the Private Key, and a _competent_ Certificate Authority (in this story that's Symantec or DigiCert, not Trustico) should only issue certificates for the names requested in the CSR, not any other names. A customer who did things sensibly (their own Private Key, make a CSR etcetera) and used Trustico say in 2016, needn't be concerned that these development will end with their certificates unilaterally revoked on Trustico's say-so. They might not want to do any more business with Trustico, but there's no particular reason this incident should affect their feelings about DigiCert or Comodo or any of the Symantec brands (Verisign / Thawte / RapidSSL / etcetera) now controlled by DigiCert.