News for hackers. Stuff that matters.

A comment on Distrusting New WoSign and StartCom Certificates. Parent comment

Re:Distrusting New WoSign and StartCom Certificates by pilif on Tuesday October 25, 2016 @09:35AM (#12787792)
> From previous statements, I believe WoSign's plan is to resell another CA's certificates during the period that they don't have a root of their own in the trust store.

or find/buy another currently trusted CA that cross-signs their new root. I'm sure they can find somebody.

edit: yes. that's what they are going to do according to https://www.wosign.com/English/News/announcement_about_Mozil...:

> There will be new SSL certificates issued by a new WoSign intermediate CA which is signed by the one of global trusted root CA, it supports all the browsers (including Firefox). This will be done within one months.

I wonder who's going to be stupid/reckless enough to sign that intermediate.

[ Parent | on HN ]
Re:Distrusting New WoSign and StartCom Certificates by pfg on Tuesday October 25, 2016 @09:54AM (#12787965)
It remains to be seen whether they will actually hold the private key for that intermediate certificate and issue end-entity certificates from it, or if this is just some sort of reselling deal where a different, trusted CA holds the key, performs domain validation, etc (which is a fairly common practice).

I have my doubts about whether Mozilla will accept them continuing to operate an actual CA with a new cross-signed certificate prior to them completing the inclusion process. CAs need to disclose these intermediate certificates, and I expect it would end up being revoked, with possible sanctions for whoever cross-signs them.

[ Parent | on HN ]
Re:Distrusting New WoSign and StartCom Certificates by tankenmate on Tuesday October 25, 2016 @09:54AM (#12787962)
Indeed, any company that signs any of their intermediates would want to have an ironclad indemnification, penalty clauses and a fully paid up escrow (hosted in a neutral country like Switzerland, Ireland or the like) in any contract.

But I suspect that another Chinese company or Chinese owned company will be selected to be the signor.

[ Parent | on HN ]
Re:Distrusting New WoSign and StartCom Certificates by bandrami on Tuesday October 25, 2016 @09:58AM (#12788012)
I wonder who's going to be stupid/reckless enough to sign that intermediate.

You have a much higher opinion of the probity (and competence) of CAs than is probably warranted.

[ Parent | on HN ]