3 ms·

@EDIT: Sorry, that was me. I've misclicked the wrong button - meant to upvote, and there seems to be no way to undo. Nonetheless, I disagree. > Do we go back a

@EDIT: Sorry, that was me. I've misclicked the wrong button - meant to upvote, and there seems to be no way to undo. Nonetheless, I disagree. > Do we go back and ask to revoke our certificate again? Free of charge? That's right, ask to revoke. In current system, considering the position CAs' are in, trust is primarily their problem. If CA's not revoking the certificate that's compromised, it's CA who's to blame, not server administrators. Not sure about server admins who don't want to pay, but end users (those who see the false green padlock) have full moral right to call such CA "evil".

yeukhon 13y ago
Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct". Like I said I don't know the cost to revoke certificate as a CA. One possible defense for StartCom is that they are worried about facing the same bill as the next critical vulnerability emerge. Someone said in some other threads that StartCom has this fee from ancient time. If that's true, this is just another "fine print" issue. > but end users (those who see the false green padlock) have full moral right to call such CA "evil". I agree. Though the question remains: should the CA take the blame of the flaw of a library every time given CA is not a charity, but a business?