Entrust Certificate Distrust
security.googleblog.com
Entrust Certificate Distrust
1–10 of 118 posts
Re: Entrust Certificate Distrust
#2Some popular users:
chase.com aa.com
Re: Entrust Certificate Distrust
#3The issues identified really show a dumpster fire: https://bugzilla.mozilla.org/buglist.cgi?o2=greaterthaneq&sh...
Directly from Entrust: "Yes, there has been ongoing internal discussion and reflection on the issues found in this and other incidents, which has led to the action items described previously and ongoing changes, including the decision to revoke the certificates affected by this bug. Exceptional circumstances would need to be provided and justified by the Subscribers. Given the nature of the feedback we have received to date, we doubt that the community has any real interest in anything that Entrust could suggest, except to use against Entrust in a destructive, not constructive, way. We therefore would like more explicit and clear guidelines or a definition of “exceptional circumstances” to be adopted and applied equally to all CAs, perhaps through updates in the CA/B Forum requirements."
Re: Entrust Certificate Distrust
#4Some popular users: chase.com aa.com
Some more:
washingtonpost.com, cdc.gov, dell.com, jpl.nasa.gov, mastercard.com
Re: Entrust Certificate Distrust
#5I wonder if Entrust can survive this. Even if Web-PKI doesn't account for the majority of their income (which it might, I genuinely don't know) this is a huge blow to their credibility.
And for a CA, credibility is everything
Re: Entrust Certificate Distrust
#6I wonder if Entrust can survive this. Even if Web-PKI doesn't account for the majority of their income (which it might, I genuinely don't know) this is a huge blow to their credibility. And for a CA, credibility is everything
Entrust has BIMI certs which use a different root (CN = Entrust Verified Mark Root Certification Authority - VMCR1) and for which your choices of a BIMI certificate are: Entrust or Digicert. I doubt it makes as much money as their web certs (BIMI certs are not super common, and they are expensive to issue since there's an actual validation process that typically involves a public notary validating the ID of a corporate officer).
If you believe https://bimiradar.com/glob
it looks like Entrust is selling on the order of a few dozen certs a week to maybe upwards of 100-200.
EDIT: I've asked Google if Gmail will be discontinuing support for Entrusts VMC certificate (and thus BIMI logos), I would guess not since BIMI has some actual requirements, but assumptions are not the best way to make decisions about risk (like our BIMI logo not working later this fall).
Re: Entrust Certificate Distrust
#7The real question is: why didn't they get booted out earlier?
Re: Entrust Certificate Distrust
#8The real question is: why didn't they get booted out earlier?
My guess is Google wanted to really give them every opportunity so that most people come to your conclusion instead of "wow! Google is just trying to censor the internet"
Re: Entrust Certificate Distrust
#9Can someone ELI5 what the violations linked in the first line are? They seem pretty minor to me but I don't understand certs
Re: Entrust Certificate Distrust
#10It always fascinates me when this happens. Don't the CAs understand that the browser vendors can and will kill their business if they don't comply with the rules? It's not like a fine that can be ignored.
How dysfunctional does a company have to be to let this happen?