Symantec Backs Its CA

Though it doesn't mention the 30000 certs or 127 certs, it does say:

(long quote from Ryan Sleevi:)

In the current misissuance, my understanding is that Symantec asserts that the totality of the misissuance was related to RAs. Symantec's initial response to the set of questions posed by Google [5] indicated that " At this time we do not have evidence that warrants suspension of privileges granted to any other RA besides CrossCert" in the same message that provided the CP/CPS for other RAs besides CrossCert, and itself a follow-up to Symantec's initial response to the Mozilla community, [6], which acknowledged for the potential of audit issues in the statement "We are reviewing E&Y’s audit work, including E&Y’s detailed approach to ascertaining how CrossCert met the required control objectives.". This appears to be similar to the previous event, in that the proposed remediation was first a termination of relationship with specific individuals. However, in Symantec's most recently reply, [1], it seems that again, on the basis of browser questions from a simple cursory examination that such a statement was not consistent with the data - that is, that the full set of issues were not identified by Symantec in their initial investigation, and only upon prompting by Browsers with a specific deadline did Symantec later recognize the scope of the issues. In recognizing the scope, it was clear that the issues did not simply relate to the use of a particular RA or auditor, but also to the practices of RAs with respect to asserting things were correct when they were not.

It appears that, similar to the Testing Tool's failure to ensure that certificates were adhering to the fulsome standards of authentication, Symantec's newly established compliance team was failing to perform even a cursory review of the CP, CPS, and audit statements presented - despite Symantec having found it necessary in that introspective process themselves in response to [3], as noted above.

Symantec's also stated that, in response to the past misissuance, it deployed a compliance assessment tool, which functionally serves a role similar to a Validation Specialist. However, such compliance assessment was designed in a way that it could be bypassed or overridden without following appropriate policies.

Most logs don't talk to random civilians about this, but at the ct-policy meeting the one log which did speak about their policies said that they either cut a $$$ deal OR they accept a mutual logging arrangement, on the rationale that if you eat the cost of logging their stuff and they eat the cost of logging your stuff, that works out fine for everybody.

What's their stance on wildcard certs with SANs? Is it simply too risky / ripe for abuse?

Not that I would really suggest this, it's a DOS waiting to happen.

And honestly, banks should have the expertise and resources to change certs in a day or two, and if they don't that's on them.

Let's Encrypt absolutely would be happy to issue you a certificate for my web site if you can use DNS to convince them you control it.

Why not for GOOGLE.IO? Well Google is very famous, and CAs are obliged to have a "High risk" policy that identifies some names as "High risk" and requires human oversight for those names. Google is probably on every high risk list ever formulated. For Let's Encrypt since they have zero humans in their validation process, the "High risk" list is a blacklist, you just get an error "Policy forbids issuing" instead of your certificate.

But "High risk" doesn't scale. It protects Google, Microsoft, HSBC, Amazon, but it's not going to protect me or most other people.

CAA protects more broadly, but it doesn't protect you against somebody with control over DNS, because it needs DNS records to work, so they could just remove or alter the records. Also CAA is only just recently becoming mandatory, it can't save you if it's ignored by the CA.