3 ms·

The complaint: https://www.courtlistener.com/docket/68995396/1/alegeus-technologies-llc-v-digicert/ https://www.courtlistener.com/docket/68995396/1/alegeus-tech

The complaint: https://www.courtlistener.com/docket/68995396/1/alegeus-technologies-llc-v-digicert/ https://www.courtlistener.com/docket/68995396/1/alegeus-tech... IANAL. > DigiCert knew or should have known about its failure to properly complete the Security Certificates for Alegeus weeks ago. 'You should have known there were bugs in your code!' > DigiCert is a voluntary member of the Certification Authority Browser Forum (CABF), which has bylaws stating that certificates with an issue in their domain validation must be revoked within 24 hours "voluntary" is technically correct, I suppose. But let's assume they'd like to be a CA? But then we go > despite that DigiCert has arbitrarily chosen this less than 24-hour window It wasn't arbitrary, it was a requirement, as the complaint itself pointed out… > Alegeus has hundreds of such Clients. Alegeus is generally required by contract to give its clients much longer than 24 hours’ notice before executing such a change regarding certification. Yet another example of that nobody ever thinks about cert rotation, ever. > Consequently, due to the errors and delays of DigiCert alone, Alegeus cannot practically make all the required changes Yeah, no, your error was not having a process to account for this in place. The TRO also states, > The threatened injury to Alegeus outweighs any injury DigiCert might suffer under the injunction. Well, if DigiCert is removed as a CA because they've violated the CA/B BRs (at least, AIUI, they have) — that could be a pretty big injury. They're probably too big to fail, and "we tried but we had a TRO" is a pretty good excuse. The TRO is scoped to only their certs, and only for 7 days (barring further orders), so it's at least pretty minimal? So I suppose DigiCert could revoke the rest.

stackskipton 2y ago
My guess is all they want is 7 days since complaints indicates they asked for 3 days. So they filed this suit, got the TRO, will do the work while TRO is underway and at hearing, declare it all moot, pay the lawyers and move on.
JoshTriplett 2y ago
What is the legal process for "cannot comply with this TRO because doing so would likely cause us to cease to exist"? It certainly is the case that "any injury DigiCert might suffer under the injunction" has the possibility of including no longer being able to be a certificate provider.
- dataflow 2y ago
  > What is the legal process for "cannot comply Appealing, I imagine? > would likely cause > has the possibility of Doesn't sound like it's "likely" in this case, so said process probably wouldn't work?
  - wbl 2y ago
    This is a TRO. Digicert hasn't been heard yet. So it's not an appeal just a regular hearing.
    - dataflow 2y ago
      I thought you can appeal a TRO, at least sometimes? Don't know if the states differ on this.
  - JoshTriplett 2y ago
    Appealing doesn't work if you're being made to comply within 24 hours before having any opportunity to prepare and make arguments. I'm wondering what the process is for showing that a TRO could potentially cause irreparable harm.
    - dataflow 2y ago
      Aren't there emergency appeals for stuff that can't wait? Like in NY there's a phone number for "Emergency Applications during nonbusiness hours": https://www.nycourts.gov/courts/ad2/contactus.shtml https://www.nycourts.gov/courts/ad2/contactus.shtml
- kmeisthax 2y ago
  The legal process is contempt of court. If CAFB revokes DigiCert than they are interfering with the TRO on DigiCert, which puts them in contempt of court.
Sakos 2y ago
The fact that the TRO was issued seems insane to me. So now DigiCert can't revoke the certificates because these jokers can't handle rotating certificates and they're making it everybody else's problem.
- tzs 2y ago
  How are they making it everyone else's problem? The TRO only applies to the certificates that were issued to the plaintiff.
8organicbits 2y ago
Think about what usually happens when a certificate isn't revoked within the 24 hour window. It's not an immediate death sentence, the CABF discusses what happened and decides if they still trust the CA to carry out their responsibilities. The CABF doesn't expect the CA to violate a court order, but there are sure to be questions about how the underscore bug happened, how their agreements should be re-written to reduce the risk of customers filing TROs, and how process has changed. Fixing bugs and re-writing agreements are solvable problems. I don't think the legal challenges shown here are unique to this CA. A good question for the CABF is how a CA can demonstrate that they've reduced this sort of legal risk. It's a hard problem because there's CAs in so many different legal jurisdictions.
- deathanatos 2y ago
  (Still not a lawyer.) To be clear, I think a TRO is also a pretty good excuse for technical of the rules, and the most likely thing is that people bend to accommodate here. > how their agreements should be re-written to reduce the risk of customers filing TRO I actually am not sure a clear agreement matters here. It could be they already have that (I didn't see evidence in the complaint that convinced me one way or the other); if the case proceeds long enough, this I expect will be evident in the ruling: either the agreement was clear, and they should have expected a possible revocation since it is inherently part of the system they're interoperating with (… this would be my default stance; ignorance of certs doesn't get you infinite leeway here) or the agreement wasn't clear at it's a contract breach as alleged. However, I also agree that, assuming they can rotate in 3 days like they said in the complaint, — but that is an assumption. I mean, IDK about your workplace, but I'm sure you've seen a deadline or ~~two~~ 100% slip? — then the case becomes moot and we'll never know, as there will be no ruling. That could very well happen, we'll have to see. > I don't think the legal challenges shown here are unique to this CA. A good question for the CABF is how a CA can demonstrate that they've reduced this sort of legal risk. It's a hard problem because there's CAs in so many different legal jurisdictions. I agree, though I think it is difficult to show that. Like I said, I'm not sure an ironclad agreement saves you from the TRO, here. The judge would still issue a TRO while deciding the agreement is, actually, ironclad, since the judge cannot start from the assumption that it is, and will err on the side of caution.

stackskipton 2y ago

My guess is all they want is 7 days since complaints indicates they asked for 3 days. So they filed this suit, got the TRO, will do the work while TRO is underway and at hearing, declare it all moot, pay the lawyers and move on.

JoshTriplett 2y ago

What is the legal process for "cannot comply with this TRO because doing so would likely cause us to cease to exist"? It certainly is the case that "any injury DigiCert might suffer under the injunction" has the possibility of including no longer being able to be a certificate provider.

dataflow 2y ago
> What is the legal process for "cannot comply Appealing, I imagine? > would likely cause > has the possibility of Doesn't sound like it's "likely" in this case, so said process probably wouldn't work?
- wbl 2y ago
  This is a TRO. Digicert hasn't been heard yet. So it's not an appeal just a regular hearing.
  - dataflow 2y ago
    I thought you can appeal a TRO, at least sometimes? Don't know if the states differ on this.
- JoshTriplett 2y ago
  Appealing doesn't work if you're being made to comply within 24 hours before having any opportunity to prepare and make arguments. I'm wondering what the process is for showing that a TRO could potentially cause irreparable harm.
  - dataflow 2y ago
    Aren't there emergency appeals for stuff that can't wait? Like in NY there's a phone number for "Emergency Applications during nonbusiness hours": https://www.nycourts.gov/courts/ad2/contactus.shtml https://www.nycourts.gov/courts/ad2/contactus.shtml
kmeisthax 2y ago
The legal process is contempt of court. If CAFB revokes DigiCert than they are interfering with the TRO on DigiCert, which puts them in contempt of court.

Sakos 2y ago

The fact that the TRO was issued seems insane to me. So now DigiCert can't revoke the certificates because these jokers can't handle rotating certificates and they're making it everybody else's problem.

tzs 2y ago
How are they making it everyone else's problem? The TRO only applies to the certificates that were issued to the plaintiff.

8organicbits 2y ago

Think about what usually happens when a certificate isn't revoked within the 24 hour window. It's not an immediate death sentence, the CABF discusses what happened and decides if they still trust the CA to carry out their responsibilities. The CABF doesn't expect the CA to violate a court order, but there are sure to be questions about how the underscore bug happened, how their agreements should be re-written to reduce the risk of customers filing TROs, and how process has changed. Fixing bugs and re-writing agreements are solvable problems. I don't think the legal challenges shown here are unique to this CA. A good question for the CABF is how a CA can demonstrate that they've reduced this sort of legal risk. It's a hard problem because there's CAs in so many different legal jurisdictions.

deathanatos 2y ago
(Still not a lawyer.) To be clear, I think a TRO is also a pretty good excuse for technical of the rules, and the most likely thing is that people bend to accommodate here. > how their agreements should be re-written to reduce the risk of customers filing TRO I actually am not sure a clear agreement matters here. It could be they already have that (I didn't see evidence in the complaint that convinced me one way or the other); if the case proceeds long enough, this I expect will be evident in the ruling: either the agreement was clear, and they should have expected a possible revocation since it is inherently part of the system they're interoperating with (… this would be my default stance; ignorance of certs doesn't get you infinite leeway here) or the agreement wasn't clear at it's a contract breach as alleged. However, I also agree that, assuming they can rotate in 3 days like they said in the complaint, — but that is an assumption. I mean, IDK about your workplace, but I'm sure you've seen a deadline or ~~two~~ 100% slip? — then the case becomes moot and we'll never know, as there will be no ruling. That could very well happen, we'll have to see. > I don't think the legal challenges shown here are unique to this CA. A good question for the CABF is how a CA can demonstrate that they've reduced this sort of legal risk. It's a hard problem because there's CAs in so many different legal jurisdictions. I agree, though I think it is difficult to show that. Like I said, I'm not sure an ironclad agreement saves you from the TRO, here. The judge would still issue a TRO while deciding the agreement is, actually, ironclad, since the judge cannot start from the assumption that it is, and will err on the side of caution.