Hacker News Reader

Existing certs (those with a notBefore date before Oct 21 [0]) are still trusted by Firefox. New certificates are not.

(WoSign could theoretically backdate the notBefore date on new certs to make them look like existing certs, but Mozilla have said that if they catch WoSign doing this they'll distrust their root totally.)

Other browsers are taking similar measures, but I'm not sure on the details.

[0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new...

Apple are trusting certs WoSign published to Certifitcate transparency server before September [0] and StartCom certs with an notbefore dates of December [1]

[0] https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...

[1] https://groups.google.com/forum/m/#!topic/mozilla.dev.securi...

The Startcom revocation wasn't retroactive. It only affects certificates issued after 2016-10-21.

Thanks for adding this clarification!

Nope; I'm sure the information is out there somewhere. There was a big discussion about grandfathering, too.