Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct".

Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct". Like I said I don't know the cost to revoke certificate as a CA. One possible defense for StartCom is that they are worried about facing the same bill as the next critical vulnerability emerge. Someone said in some other threads that StartCom has this fee from ancient time. If that's true, this is just another "fine print" issue. > but end users (those who see the false green padlock) have full moral right to call such CA "evil". I agree. Though the question remains: should the CA take the blame of the flaw of a library every time given CA is not a charity, but a business?