3 ms·

> In any event, given that Alegeus was aware that DigiCert is required to revoke certificates within 24 hours, one wonders why Alegeus went ahead and signed agr

> In any event, given that Alegeus was aware that DigiCert is required to revoke certificates within 24 hours, one wonders why Alegeus went ahead and signed agreements with their customers that required a lengthy notice period before changing certificates. It seems obvious enough how this would come about: 1. The healthcare company knows better than to do a Crowdstrike, where "just a configuration change" is rushed out with inadequate testing, for "security". As even a configuration change could trigger a latent bug, they agree configuration changes should be rolled out gradually, and not applied during clients' peak operating hours. 2. The healthcare company could have used "Let's Encrypt" to get certificates for free, if they wanted short-term certificates. But instead they paid $$$$ to DigiCert for certificates with a 12 month duration. 3. Even if Alegeus had read the small print saying mis-issued certificates can be revoked with only 24 hours of notice - they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates. Hasn't DigiCert told the browser vendors precisely that?

mynameisvlad 2y ago
> 3. Even if Alegeus had read the small print saying mis-issued certificates can be revoked with only 24 hours of notice - they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates. Hasn't DigiCert told the browser vendors precisely that? I mean, sure, in theory there should be controls in place, but no company or process is perfect. That's why there's a process in place to respond to problems with issuance in the first place. DigiCert is responding in the way the browser vendors mandate; 24-hour revocation, per the article, is a baseline requirement to be a CA.
bastawhiz 2y ago
> they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates This makes no sense. The revoke certs when there's been an incident. Telling customers that they might need to revoke certs in the event of an incident should mean that they are going to be free from incidents?? If Stripe tells me webhooks might be delivered more than once, that does NOT mean I would assume they have controls in place to prevent webhooks from being delivered more than once. That's just wild to assume.
- TheJoeMan 2y ago
  My very naive reading is Alegeus may have assumed this certificate revocation would only be from their own screw up - such as publishing their private key somewhere - and they would of course eat some costs on the SLA’s. Instead, we have Alegeus’s vendor saying there was technically the possibility, unconfirmed, that the key could have been compromised, and therefore are executing the nuclear option.
  - bastawhiz 2y ago
    Whether Digicert is liable for damages is another matter (they are and probably should be). What's pertinent is that Alegeus is now blocking that nuclear option.
- michaelt 2y ago
  > This makes no sense. To make it clear what I mean, imagine this hypothetical conversation: Alegeus: "We need a certificate with a longer life than the 3 months we can get from Lets Encrypt" DigiCert: "That is our core business. We will sell you a 12 month certificate. It may be revoked early, if it was mis-issued." Alegeus: "I particularly need a 12 month certificate, as I mentioned. Is revocation likely? Do you often mis-issue certificates? To your knowledge, are you currently mis-issuing certificates?" CA/Browser Forum: "Yeah DigiCert, is it likely? Are you currently mis-issuing certificates?" DigiCert: "We have a number of organisational and technical controls in place to prevent certificates being mis-issued. We do not have a history of mis-issuing certificates, and to our knowledge we are not currently mis-issuing certificates. Our controls have passed third-party audits." Alegeus: "OK, so to the best of your knowledge as certificate industry experts, this 12 month cert you're selling me will be valid for 12 months?" DigiCert: "To the best of our knowledge, yes."
  - bastawhiz 2y ago
    To make it clear what I mean, imagine this hypothetical conversation: Supermarket: "We need a candy bar they we can sell to our customers" Hershey: "That is our core business. We will sell you candy. It may be recalled, if we discover problems." Supermarket: "Is a recall likely? Do you often recall candy? To your knowledge, are you currently selling bad candy?" FDA: "Yeah Hershey, is it likely? Are you currently making toxic candy?" Hershey: "We have a number of organisational and technical controls in place to prevent contaminated candy. We do not have a history of contamination, and to our knowledge we are not currently contaminating candy. Our controls have passed third-party audits." Supermarket: "OK, so to the best of your knowledge as candy experts, this candy you're selling me will be good to sell?" Hershey: "To the best of our knowledge, yes." If someone warns you about a possible eventuality, you simply don't pretend that the eventuality is impossible. That's why they warned you. Obviously nobody wants that. It's just plain ignorant to have a shocked Pikachu face when the thing they warned you might happen in extenuating circumstances happens.

mynameisvlad 2y ago

> 3. Even if Alegeus had read the small print saying mis-issued certificates can be revoked with only 24 hours of notice - they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates. Hasn't DigiCert told the browser vendors precisely that? I mean, sure, in theory there should be controls in place, but no company or process is perfect. That's why there's a process in place to respond to problems with issuance in the first place. DigiCert is responding in the way the browser vendors mandate; 24-hour revocation, per the article, is a baseline requirement to be a CA.

bastawhiz 2y ago

> they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates This makes no sense. The revoke certs when there's been an incident. Telling customers that they might need to revoke certs in the event of an incident should mean that they are going to be free from incidents?? If Stripe tells me webhooks might be delivered more than once, that does NOT mean I would assume they have controls in place to prevent webhooks from being delivered more than once. That's just wild to assume.

TheJoeMan 2y ago
My very naive reading is Alegeus may have assumed this certificate revocation would only be from their own screw up - such as publishing their private key somewhere - and they would of course eat some costs on the SLA’s. Instead, we have Alegeus’s vendor saying there was technically the possibility, unconfirmed, that the key could have been compromised, and therefore are executing the nuclear option.
- bastawhiz 2y ago
  Whether Digicert is liable for damages is another matter (they are and probably should be). What's pertinent is that Alegeus is now blocking that nuclear option.
michaelt 2y ago
> This makes no sense. To make it clear what I mean, imagine this hypothetical conversation: Alegeus: "We need a certificate with a longer life than the 3 months we can get from Lets Encrypt" DigiCert: "That is our core business. We will sell you a 12 month certificate. It may be revoked early, if it was mis-issued." Alegeus: "I particularly need a 12 month certificate, as I mentioned. Is revocation likely? Do you often mis-issue certificates? To your knowledge, are you currently mis-issuing certificates?" CA/Browser Forum: "Yeah DigiCert, is it likely? Are you currently mis-issuing certificates?" DigiCert: "We have a number of organisational and technical controls in place to prevent certificates being mis-issued. We do not have a history of mis-issuing certificates, and to our knowledge we are not currently mis-issuing certificates. Our controls have passed third-party audits." Alegeus: "OK, so to the best of your knowledge as certificate industry experts, this 12 month cert you're selling me will be valid for 12 months?" DigiCert: "To the best of our knowledge, yes."
- bastawhiz 2y ago
  To make it clear what I mean, imagine this hypothetical conversation: Supermarket: "We need a candy bar they we can sell to our customers" Hershey: "That is our core business. We will sell you candy. It may be recalled, if we discover problems." Supermarket: "Is a recall likely? Do you often recall candy? To your knowledge, are you currently selling bad candy?" FDA: "Yeah Hershey, is it likely? Are you currently making toxic candy?" Hershey: "We have a number of organisational and technical controls in place to prevent contaminated candy. We do not have a history of contamination, and to our knowledge we are not currently contaminating candy. Our controls have passed third-party audits." Supermarket: "OK, so to the best of your knowledge as candy experts, this candy you're selling me will be good to sell?" Hershey: "To the best of our knowledge, yes." If someone warns you about a possible eventuality, you simply don't pretend that the eventuality is impossible. That's why they warned you. Obviously nobody wants that. It's just plain ignorant to have a shocked Pikachu face when the thing they warned you might happen in extenuating circumstances happens.