or find/buy another currently trusted CA that cross-signs their new root. I'm sure they can find somebody.
edit: yes. that's what they are going to do according to https://www.wosign.com/English/News/announcement_about_Mozil...:
> There will be new SSL certificates issued by a new WoSign intermediate CA which is signed by the one of global trusted root CA, it supports all the browsers (including Firefox). This will be done within one months.
I wonder who's going to be stupid/reckless enough to sign that intermediate.
I have my doubts about whether Mozilla will accept them continuing to operate an actual CA with a new cross-signed certificate prior to them completing the inclusion process. CAs need to disclose these intermediate certificates, and I expect it would end up being revoked, with possible sanctions for whoever cross-signs them.
But I suspect that another Chinese company or Chinese owned company will be selected to be the signor.
No. As the article states, it will affect any certificates that chain up to the specified root certificates (including and intermediate and end-entity certificates).
> I see they say that they will have a workaround in place ...
From previous statements, I believe WoSign's plan is to resell another CA's certificates during the period that they don't have a root of their own in the trust store.