Distrusting New WoSign and StartCom Certificates

Re:Distrusting New WoSign and StartCom Certificates by 0x0 on Tuesday October 25, 2016 @09:02AM (#12787555)

Interestingly, over at the Google Certificate Transparency group, it looks like both StartCom's and WoSign's CT log servers were recently included into Chrome.

https://groups.google.com/a/chromium.org/forum/#!topic/ct-po...

[ Parent | on HN ]

Re:Distrusting New WoSign and StartCom Certificates by iancarroll on Tuesday October 25, 2016 @09:11AM (#12787619)

Luckily CT logs are designed to be mostly trustless.

[ Parent | on HN ]

Re:Distrusting New WoSign and StartCom Certificates by 0x0 on Tuesday October 25, 2016 @04:07PM (#12791207)

Yet the Izenpe CT log managed to be untrustworthy enough to be de-listed! https://groups.google.com/a/chromium.org/forum/#!topic/ct-po...

[ Parent | on HN ]

Re:Distrusting New WoSign and StartCom Certificates by iancarroll on Tuesday October 25, 2016 @10:48PM (#12793522)

Indeed. For those curious, CT is designed to "discover" SCTs that were not publicly shown by the log, so that the log can operate without a lot of trust, though this did not happen here (someone just found them operating two logs...)

I guess I'm not the best person to criticize other logs, though. :-)

[ Parent | on HN ]

Re:Distrusting New WoSign and StartCom Certificates by dorianm on Tuesday October 25, 2016 @09:29AM (#12787749)

"Please note that while both Symantec and CNNIC's logs are presently enabled in the current Chrome stable release (Chrome 52), both WoSign and StartCom's logs will not be recognized until Chrome 54, which is presently the Dev channel release."

[ Parent | on HN ]

Re:Distrusting New WoSign and StartCom Certificates by randomfool on Tuesday October 25, 2016 @01:05PM (#12789603)

https://googlechromereleases.blogspot.com/2016/10/stable-cha...

Chrome 54 is now in stable.

[ Parent | on HN ]