> 3. Even if Alegeus had read the small print saying mis-issued certificates can be revoked with only 24 hours of notice - they quite reasonably assumed DigiCer

> 3. Even if Alegeus had read the small print saying mis-issued certificates can be revoked with only 24 hours of notice - they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates. Hasn't DigiCert told the browser vendors precisely that? I mean, sure, in theory there should be controls in place, but no company or process is perfect. That's why there's a process in place to respond to problems with issuance in the first place. DigiCert is responding in the way the browser vendors mandate; 24-hour revocation, per the article, is a baseline requirement to be a CA.