Hacker News Reader

schraugeron The story of how WoSign gave me an SSL certificate for GitHub

WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate.

That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are still compatible.

schraugeron The story of how WoSign gave me an SSL certificate for GitHub

Yeah, I still think it shouldn't be considered a duplicate. Especially since going directly to WoSign didn't end up solving the overall problem, which is what the linked duplicate question says to do.

schraugeron Chinese CA WoSign faces revocation after possibly issuing fake certificates

Just FYI, since you only quoted one certificate. Both GitHub certificates were mine, not just the one. I created a second account for the second certificate.