> their only crime is using a crap CA
thing is the whole castle is built upon trust.
if you don't punish crap CA and ppl who don't do research first, things will deteriorate rapidly.
thing is the whole castle is built upon trust.
if you don't punish crap CA and ppl who don't do research first, things will deteriorate rapidly.
Is there a way customers would have or could have known beforehand that this CA was fishy? I agree that the CA should be punished/ostracized, but it isn't obvious to me that most of its customers would have known they were a fishy CA.
https://news.ycombinator.com/item?id=8982013
" It's 2015. They're using SHA-1 for everything (NOOOO!). They're based in China, which has just said it wants to ban encryption. It looks like they've messed up OSCP, so even their own cert doesn't pass. Oh, and RC4, TLS 1.0 "
I think something should be done, but it's not my call of course. Given we do have Let's Encrypt now, I wouldn't feel in the least bit sad in revoking the WoSign certs. Anyone affected can, and should, change.
It's disappointing to see my concerns back then were well-placed, and there are clear indications StartCom's and WoSign's backends are connected together somehow?! I don't know what's going on there exactly, and someone should definitely find out.