3 ms·

I have no problem with them asking for money to issue a new certificate, but revoking the old one when it is compromised is an obligation they took on when sell

I have no problem with them asking for money to issue a new certificate, but revoking the old one when it is compromised is an obligation they took on when selling (or giving it away) in the first place. An obligation to Mozilla and others that have put them in their trust store if I may add. It is the same reason we have mandatory recycling provisions. Just because your shit is free doesn't mean we have to sit by and watch you pollute the world.

Joeboy 13y ago
Hm, by that argument I guess they (and all other CAs) should just revoke all of the ones on servers that are/were vulnerable without user intervention. I can't imagine that would make them any more popular, although it probably would be the right thing to do.
deleted 13y ago
[deleted]