3 ms·

DigiCert bought Symantec's TLS/PKI business, to quote wikipedia: > including brands GeoTrust, RapidSSL, Thawte and VeriSign

tialaramex 7y ago
In particular, and relevant to this rant, to permit the acquisition to take effect DigiCert had to explain to stakeholders (Google, Mozilla and perhaps others) in some detail that this was NOT a reverse takeover, the resulting organisation would NOT be Symantec's CA but now named DigiCert, it still would be DigiCert but now with Symantec's famous brands like Thawte and VeriSign -- thus it would not be infected by poor management processes and inadequate risk controls. The reason this was important is that Symantec's oversight had been judged lacking -- business as usual was not an option, they were asking big CAs like DigiCert about pricing for basically a white labelling service. The trustworthy CA would run everything for a few years and Symantec would own the brands while internally rebuilding to get trust back. In that discussion with DigiCert apparently just selling Symantec's CA function outright was the more attractive option than whatever eye-watering sum such white labelling would have cost.
- stephenr 7y ago
  Is there any evidence that the issue at hand is anything more than just customer service though? I don’t see any mention of actual CA issues (ie following proper issuance policies, etc) And to be fair, when it comes to shit customer service Google would look at Symantec, laugh and say “hold my beer”.
  - tialaramex 7y ago
    No, sorry it was unclear, my point was that unlike normal we actually have independent evidence that this was NOT about DigiCert becoming Symantec, because that was a requirement for these stakeholders. So at most this is just "Popular product's customer services made worse due to expansion" a familiar story which rarely signifies much. And to be honest the parent article's main thrust comes across as "Wah, I had to pay full price" which like, I'm not even getting out my record-breaking world's tiniest violin for that, who cares?
    - stephenr 7y ago
      Right that makes more sense now! Agreed.

tialaramex 7y ago

In particular, and relevant to this rant, to permit the acquisition to take effect DigiCert had to explain to stakeholders (Google, Mozilla and perhaps others) in some detail that this was NOT a reverse takeover, the resulting organisation would NOT be Symantec's CA but now named DigiCert, it still would be DigiCert but now with Symantec's famous brands like Thawte and VeriSign -- thus it would not be infected by poor management processes and inadequate risk controls. The reason this was important is that Symantec's oversight had been judged lacking -- business as usual was not an option, they were asking big CAs like DigiCert about pricing for basically a white labelling service. The trustworthy CA would run everything for a few years and Symantec would own the brands while internally rebuilding to get trust back. In that discussion with DigiCert apparently just selling Symantec's CA function outright was the more attractive option than whatever eye-watering sum such white labelling would have cost.

stephenr 7y ago
Is there any evidence that the issue at hand is anything more than just customer service though? I don’t see any mention of actual CA issues (ie following proper issuance policies, etc) And to be fair, when it comes to shit customer service Google would look at Symantec, laugh and say “hold my beer”.
- tialaramex 7y ago
  No, sorry it was unclear, my point was that unlike normal we actually have independent evidence that this was NOT about DigiCert becoming Symantec, because that was a requirement for these stakeholders. So at most this is just "Popular product's customer services made worse due to expansion" a familiar story which rarely signifies much. And to be honest the parent article's main thrust comes across as "Wah, I had to pay full price" which like, I'm not even getting out my record-breaking world's tiniest violin for that, who cares?
  - stephenr 7y ago
    Right that makes more sense now! Agreed.