Apple's response to the WoSign incidents

Re:Apple's response to the WoSign incidents by cptskippy on Saturday October 01, 2016 @03:02PM (#12619365)

    When this came up, the first thing I did was generate wildcard certs for our StartCom domains

A vendor you used comes under scrutiny so your response is to double down on them? Did you have prepaid credits or something? It seems like that would have been a opportune time to migrate away from them since you'd have to redeploy certs anyways.

[ Parent | on HN ]

Re:Apple's response to the WoSign incidents by justinclift on Saturday October 01, 2016 @03:46PM (#12619578)

With StartCom, once you've gone through the personal verification procedure you don't need to pay more money for new certs, nor wildcard ones.

So, no "doubling down" involved. Just a desire to have actually working certs before Mozilla's "to be announced" cut off date happens.

And then Apple comes along and (unless I'm misunderstanding) all of our certs will be useless. :(

[ Parent | on HN ]

Re:Apple's response to the WoSign incidents by NetStrikeForce on Saturday October 01, 2016 @04:06PM (#12619660)

You should get a refund from your cert provider.

[ Parent | on HN ]

Re:Apple's response to the WoSign incidents by stephenr on Sunday October 02, 2016 @03:04AM (#12621352)

> So, no "doubling down" involved

Continuing to use a CA that has a recognised history of fucking abysmal security and wilfully deceptive actions, whether you're paying money or not, is still "doubling down" IMO.

If you're getting a wildcard cert, you aren't getting EV, so why not just make the switch to LetsEncrypt?

[ Parent | on HN ]