News for hackers. Stuff that matters.

A comment on Apple's response to the WoSign incidents. Parent comment

Re:Apple's response to the WoSign incidents by justinclift on Saturday October 01, 2016 @03:46PM (#12619578)
With StartCom, once you've gone through the personal verification procedure you don't need to pay more money for new certs, nor wildcard ones.

So, no "doubling down" involved. Just a desire to have actually working certs before Mozilla's "to be announced" cut off date happens.

And then Apple comes along and (unless I'm misunderstanding) all of our certs will be useless. :(

[ Parent | on HN ]
Re:Apple's response to the WoSign incidents by NetStrikeForce on Saturday October 01, 2016 @04:06PM (#12619660)
You should get a refund from your cert provider.
[ Parent | on HN ]
Re:Apple's response to the WoSign incidents by stephenr on Sunday October 02, 2016 @03:04AM (#12621352)
> So, no "doubling down" involved

Continuing to use a CA that has a recognised history of fucking abysmal security and wilfully deceptive actions, whether you're paying money or not, is still "doubling down" IMO.

If you're getting a wildcard cert, you aren't getting EV, so why not just make the switch to LetsEncrypt?

[ Parent | on HN ]