Hacker News Reader

Comment by tptacek | Hacker News Reader

For anyone who doesn't know the backstory on this already: WoSign (and, after WoSign quietly acquired it, StartCom) were distrusted by Mozilla for mismanagement ranging from backdating certificate to bypass crypto requirements to accidentally mis-issuing certificates.

It is unlikely that WoSign or any CA run by WoSign will ever fully compatible with browsers in the future.

View on HN

Startcom's certs still show as ok in Firefox for me. Any idea when this kicks in?

Nope; I'm sure the information is out there somewhere. There was a big discussion about grandfathering, too.

The Startcom revocation wasn't retroactive. It only affects certificates issued after 2016-10-21.

Thanks for adding this clarification!

Existing certs (those with a notBefore date before Oct 21 [0]) are still trusted by Firefox. New certificates are not.

(WoSign could theoretically backdate the notBefore date on new certs to make them look like existing certs, but Mozilla have said that if they catch WoSign doing this they'll distrust their root totally.)

Other browsers are taking similar measures, but I'm not sure on the details.

[0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new...

Apple are trusting certs WoSign published to Certifitcate transparency server before September [0] and StartCom certs with an notbefore dates of December [1]

[0] https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...

[1] https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...

Are they distrusted by iOS and macOS?

https://support.apple.com/en-us/HT204132

In the long run: indefinite (likely permanent) distrust by Mozilla is probably the death sentence for any CA.

It looks like WoSign is already back at it, reselling certs from another CA. I understand someone else is doing the issuing, but I'd hoped that they would die a quick death, not hang on bitterly: https://groups.google.com/forum/#!topic/mozilla.dev.security...

Has anyone else noticed that Richard Wang has replied on both this linked to thread, and the parent thread now. I thought I had read that he had stepped down as the WoSign CEO?

Reply on news.ycombinator.com