Hacker News Reader

Comment by fallingsquirrel | Hacker News Reader

> We note that other customers have also initiated legal action against us to block revocation.

This seems crazy to me. In what world does suing your business partner make more sense than clicking some buttons in a UI or running some shell commands to renew your cert?

View on HN

Maybe some mobile apps or IoT hardware with pinned certs that would all need to be rolled first? So they could get a new cert immediately but still need the old one for a while until the roll over completes.

Here's one of the complaints against digicert: https://storage.courtlistener.com/recap/gov.uscourts.utd.149...

> IN THE UNITES STATES DISTRICT COURT IN AND FOR THE DISTRICT OF UTAH, CENTRAL DIVISION

Is UNITES > UNITED a typo? Would that cause any weird legal consequences, or are typos (if it is a typo) like this just accepted?

Yes, no, yes.

Ops here, there is probably plenty of companies who use Digicert for various certs and nothing is automated. Also, in any regulatory strict company, filling out all Change Controls and pushing them through approval process would be take me longer then 24 hours.

"Clicking some buttons" gets hard if you have hundreds of certificates, or the responsible people are on vacation, or are using the certificates in ways other than securing a website. 24 hours is a very short window.

And particularly if you have a lot of devices and staggered rollout.

Deploying to all devices at once relieved the timing problem, but has its own set of problems. Ask the crowdstrike customers.

If you publish a cert for your product and require (for whatever reason) all 3rd parties validate the cert before using it, you're going to have a very bad time here. It could cost you contracts.

Now, this could be the fault digicert's customers, but suing to block revocation would be logical.

Reply on news.ycombinator.com