21–30 of 48 posts
Solution 3: cease trusting StartSSL certs issued before 2014-04-07? This is implied by the request itself but is it possible to implement?
This is actually not enough as you cannot be sure that certificates generated after that have never been used on a server with a vulnerable OpenSSL implementation.
So, if StartCom is removed from trusted CAs you will have to buy a new certificate and spend $$$, something you obviously want to avoid. That's stupid.
And worse, the Debian developers would be at fault. This is a sticky situation, really. On one hand, StartCom's pricing structure is fairly upfront. On the other hand, extracting $25 from every customer because of a bug they have no control over is dick behavior of the highest order. Ideally they'd put out a notice saying that they will offer a one-time rekey for free. Without getting into ethics, it's an entirely au…
Earlier quoted context omitted.
And worse, the Debian developers would be at fault. This is a sticky situation, really. On one hand, StartCom's pricing structure is fairly upfront. On the other hand, extracting $25 from every customer because of a bug they have no control over is dick behavior of the highest order. Ideally they'd put out a notice saying that they will offer a one-time rekey for free. Without getting into ethics, it's an entirely au…
I don't think it is dick behavior at all. That has always been their policy. They have no control of the software originating the problem. It is up to them to wave or not but not choosing to doesn't make the anything but a business.
A CA profiting from a vulnerability is a fairly perverse incentive, too.
TL/DR from the Mozilla bugzilla ( https://bugzilla.mozilla.org/show_bug.cgi?id=994033 ) There doesn't appear to be a definitive argument as to should they or should they not waive their revocation fee. On the side of StartCom an extremly resonable point as to why they should not waive their fee: > Every other certificate provider requires payment for certificates. StartCom is the one provider offering free certificat…
" Revocations carry a handling fee of currently US$ 24.90. Class 1 subscribers may use a different sub domain in order to create additional certificates without the need to revoke a previously created certificate. Alternatively it's possible to upgrade to Class 2 level which allows to create the same set of certificates once again (besides all the other benefits), because different levels are issued by different issuers, making revocation unnecessary."
I understand where Mozilla's coming from here, but I also see it from StartCom's side. StartCom requires manual verification for certain sensitive CA operations, so they've set up their (quite reasonable) fee schedule accordingly. Likewise, I'm sure that the terms and conditions of other CAs states that in the case of a key compromise, sure, they'll revoke the certificate for free, but the user must buy a new certificate to replace the compromised one - which is basically the same thing as StartCom charging for revocation.
However, even though I own some certs with StartCom, I personally think this comment has literally no basis.
Looking at the CA market - if anything - we should be happy that a CA like StartCom exists. It is a very small team lead by Eddy Nigg (he is very helpful by the way) and given that they are the ONLY ones (as far as I am aware) offering free certs - we should applaud them. Besides, the fee for revoking is very small.
I also was very much aware that revoking a cert had a charge before I signed up for one - I think it is pretty clear - so not a problem for me at all. Of course if I had to revoke a cert because of StartCom's mistake that would be a different story.
Bare in mind these are only domain validated certificates - perfect for small website owners who wish to offer their site over httpS without paying any extra fee.
Earlier quoted context omitted.
I don't think it is dick behavior at all. That has always been their policy. They have no control of the software originating the problem. It is up to them to wave or not but not choosing to doesn't make the anything but a business.
So it's a business. So it's policy. Those are not defenses. A CA profiting from a vulnerability is a fairly perverse incentive, too.
Their whole purpose is to help with the authentication side of security. They didn't force anyone to use buggy code written by a third party and it is not their fault that many of their customers have gone and done so.
StartCom customers knew the pricing before they signed up. They should take the hit. What more is there to it?
please remove all CA root certificate becaue they all charge fees for certs and that discourages spreading TLS and https more broadly?
I think the optimal thing would be moving the job of identity verification into OpenID identity providers. So you could create a plain OpenID identity, or pay for a verified OpenID identity. Then, CAs would just be infrastructure to issue free certs to whichever verified identity obviously owns them.
In fact, if identity verification came before domain registration et al., the certificate-issuance part could even be done proactively: you'd buy a domain, put your verified OpenID in the SOA record, and then some CA-bot would notice, prompt your identity provider to generate a CSR using the private key the identity provider has on file, and then send back a signed cert.