3 ms·

They have put out a statement[1], although it's in Dutch. Assuming Google's translation conveys the gist and tone of it, they seem more irritated that the brows

They have put out a statement[1], although it's in Dutch. Assuming Google's translation conveys the gist and tone of it, they seem more irritated that the browser vendors are removing the root certificates than anything else. [1] http://www.diginotar.nl/Actueel/tabid/264/articleType/ArticleView/articleId/327/Default.aspx http://www.diginotar.nl/Actueel/tabid/264/articleType/Articl...

X-Istence 15y ago
That is exactly what the article comes over as. They seem to be annoyed with the fact that their roots were being pulled when they claim only a single subroot was compromised. They are willing to give people new certificates chained to the PKIOverheid, but that comes with the rules and requirements of those certs, and looking at later news it sounds like the Dutch government has revoked their access to that and will be taking over.
Michiel 15y ago
This: "Gebruikers van SSL certificaten kunnen afhankelijk van de desbetreffende browserleverancier geconfronteerd worden met een mededeling dat het certificaat niet vertrouwd wordt. Dit is in 99,9% van de gevallen onjuist, het certificaat kan wel worden vertrouwd. Dit kan handmatig door de gebruiker zelf worden aangegeven in de browser (hiervoor kunt u terecht op de FAQ op onze website)." Translates (roughly) to this: Depending on the browsers a user of SSL certificates may be confronted with a message stating the certificate is not trusted. In 99.9% of the cases this is not correct, the certificate can be trusted. The user can do this manually using his browser (see our FAQ). --- Given the situation I don't think that is the right message. I think people should not be told that 99.9% of certificates can be trusted even though their computer says no.
- stingraycharles 15y ago
  That's terrible that they're saying that. You would expect a CA to be the last person to try to educate others to ignore those warnings. It kind of undermines their whole reason of existence.
  - marshray 15y ago
    One explanation is that they just don't understand that. Another is that they don't give a flip about their CA business at this point because it's just a liability to them that they wish would just go away. If they're going to have any customer left after this it's going to be gov.nl, who seems to prefer having a pwned CA to re-rooting their whole PKI setup.

X-Istence 15y ago

That is exactly what the article comes over as. They seem to be annoyed with the fact that their roots were being pulled when they claim only a single subroot was compromised. They are willing to give people new certificates chained to the PKIOverheid, but that comes with the rules and requirements of those certs, and looking at later news it sounds like the Dutch government has revoked their access to that and will be taking over.

Michiel 15y ago

This: "Gebruikers van SSL certificaten kunnen afhankelijk van de desbetreffende browserleverancier geconfronteerd worden met een mededeling dat het certificaat niet vertrouwd wordt. Dit is in 99,9% van de gevallen onjuist, het certificaat kan wel worden vertrouwd. Dit kan handmatig door de gebruiker zelf worden aangegeven in de browser (hiervoor kunt u terecht op de FAQ op onze website)." Translates (roughly) to this: Depending on the browsers a user of SSL certificates may be confronted with a message stating the certificate is not trusted. In 99.9% of the cases this is not correct, the certificate can be trusted. The user can do this manually using his browser (see our FAQ). --- Given the situation I don't think that is the right message. I think people should not be told that 99.9% of certificates can be trusted even though their computer says no.

stingraycharles 15y ago
That's terrible that they're saying that. You would expect a CA to be the last person to try to educate others to ignore those warnings. It kind of undermines their whole reason of existence.
- marshray 15y ago
  One explanation is that they just don't understand that. Another is that they don't give a flip about their CA business at this point because it's just a liability to them that they wish would just go away. If they're going to have any customer left after this it's going to be gov.nl, who seems to prefer having a pwned CA to re-rooting their whole PKI setup.