News for hackers. Stuff that matters.

A comment on StartCom will log all issued SSL certificates to public CT log servers. Parent comment

Re:StartCom will log all issued SSL certificates to public C... by Namidairo on Wednesday March 23, 2016 @12:11PM (#11345728)
I don't think that was really an option in this case as his CA just went and published the logs without asking the users first?
[ Parent | on HN ]
Re:StartCom will log all issued SSL certificates to public C... by BillinghamJ on Wednesday March 23, 2016 @01:01PM (#11346232)
I'm pretty sure they're not publishing any existing certificates, so that's okay, but they definitely need to treat the fact that they are doing from now on as a "breaking change" and be very clear about it to existing users.
[ Parent | on HN ]
Re:StartCom will log all issued SSL certificates to public C... by geofft on Wednesday March 23, 2016 @01:41PM (#11346569)
Yeah, I don't know what StartCom is actually doing. All I'm saying is that StartCom has the option of redacting the labels, and as a paying customer, they should be asking StartCom to do so.
[ Parent | on HN ]
Re:StartCom will log all issued SSL certificates to public C... by agwa on Wednesday March 23, 2016 @02:17PM (#11346892)
RFC6962bis is still a draft and there are no implementations of it yet, so actually they don't have the option to redact labels.
[ Parent | on HN ]