3 ms·

> they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates This makes no sense. The revoke certs when there's been

> they quite reasonably assumed DigiCert would have controls in place to avoid mis-issued certificates This makes no sense. The revoke certs when there's been an incident. Telling customers that they might need to revoke certs in the event of an incident should mean that they are going to be free from incidents?? If Stripe tells me webhooks might be delivered more than once, that does NOT mean I would assume they have controls in place to prevent webhooks from being delivered more than once. That's just wild to assume.

TheJoeMan 2y ago
My very naive reading is Alegeus may have assumed this certificate revocation would only be from their own screw up - such as publishing their private key somewhere - and they would of course eat some costs on the SLA’s. Instead, we have Alegeus’s vendor saying there was technically the possibility, unconfirmed, that the key could have been compromised, and therefore are executing the nuclear option.
- bastawhiz 2y ago
  Whether Digicert is liable for damages is another matter (they are and probably should be). What's pertinent is that Alegeus is now blocking that nuclear option.
michaelt 2y ago
> This makes no sense. To make it clear what I mean, imagine this hypothetical conversation: Alegeus: "We need a certificate with a longer life than the 3 months we can get from Lets Encrypt" DigiCert: "That is our core business. We will sell you a 12 month certificate. It may be revoked early, if it was mis-issued." Alegeus: "I particularly need a 12 month certificate, as I mentioned. Is revocation likely? Do you often mis-issue certificates? To your knowledge, are you currently mis-issuing certificates?" CA/Browser Forum: "Yeah DigiCert, is it likely? Are you currently mis-issuing certificates?" DigiCert: "We have a number of organisational and technical controls in place to prevent certificates being mis-issued. We do not have a history of mis-issuing certificates, and to our knowledge we are not currently mis-issuing certificates. Our controls have passed third-party audits." Alegeus: "OK, so to the best of your knowledge as certificate industry experts, this 12 month cert you're selling me will be valid for 12 months?" DigiCert: "To the best of our knowledge, yes."
- bastawhiz 2y ago
  To make it clear what I mean, imagine this hypothetical conversation: Supermarket: "We need a candy bar they we can sell to our customers" Hershey: "That is our core business. We will sell you candy. It may be recalled, if we discover problems." Supermarket: "Is a recall likely? Do you often recall candy? To your knowledge, are you currently selling bad candy?" FDA: "Yeah Hershey, is it likely? Are you currently making toxic candy?" Hershey: "We have a number of organisational and technical controls in place to prevent contaminated candy. We do not have a history of contamination, and to our knowledge we are not currently contaminating candy. Our controls have passed third-party audits." Supermarket: "OK, so to the best of your knowledge as candy experts, this candy you're selling me will be good to sell?" Hershey: "To the best of our knowledge, yes." If someone warns you about a possible eventuality, you simply don't pretend that the eventuality is impossible. That's why they warned you. Obviously nobody wants that. It's just plain ignorant to have a shocked Pikachu face when the thing they warned you might happen in extenuating circumstances happens.

TheJoeMan 2y ago

My very naive reading is Alegeus may have assumed this certificate revocation would only be from their own screw up - such as publishing their private key somewhere - and they would of course eat some costs on the SLA’s. Instead, we have Alegeus’s vendor saying there was technically the possibility, unconfirmed, that the key could have been compromised, and therefore are executing the nuclear option.

bastawhiz 2y ago
Whether Digicert is liable for damages is another matter (they are and probably should be). What's pertinent is that Alegeus is now blocking that nuclear option.

michaelt 2y ago

> This makes no sense. To make it clear what I mean, imagine this hypothetical conversation: Alegeus: "We need a certificate with a longer life than the 3 months we can get from Lets Encrypt" DigiCert: "That is our core business. We will sell you a 12 month certificate. It may be revoked early, if it was mis-issued." Alegeus: "I particularly need a 12 month certificate, as I mentioned. Is revocation likely? Do you often mis-issue certificates? To your knowledge, are you currently mis-issuing certificates?" CA/Browser Forum: "Yeah DigiCert, is it likely? Are you currently mis-issuing certificates?" DigiCert: "We have a number of organisational and technical controls in place to prevent certificates being mis-issued. We do not have a history of mis-issuing certificates, and to our knowledge we are not currently mis-issuing certificates. Our controls have passed third-party audits." Alegeus: "OK, so to the best of your knowledge as certificate industry experts, this 12 month cert you're selling me will be valid for 12 months?" DigiCert: "To the best of our knowledge, yes."

bastawhiz 2y ago
To make it clear what I mean, imagine this hypothetical conversation: Supermarket: "We need a candy bar they we can sell to our customers" Hershey: "That is our core business. We will sell you candy. It may be recalled, if we discover problems." Supermarket: "Is a recall likely? Do you often recall candy? To your knowledge, are you currently selling bad candy?" FDA: "Yeah Hershey, is it likely? Are you currently making toxic candy?" Hershey: "We have a number of organisational and technical controls in place to prevent contaminated candy. We do not have a history of contamination, and to our knowledge we are not currently contaminating candy. Our controls have passed third-party audits." Supermarket: "OK, so to the best of your knowledge as candy experts, this candy you're selling me will be good to sell?" Hershey: "To the best of our knowledge, yes." If someone warns you about a possible eventuality, you simply don't pretend that the eventuality is impossible. That's why they warned you. Obviously nobody wants that. It's just plain ignorant to have a shocked Pikachu face when the thing they warned you might happen in extenuating circumstances happens.