Re: Replacing StartCom certificate

On Thu, Oct 20, 2016 at 10:44:47PM -0500, Yang Yu wrote:
> According to the bug, the current action affects new certificates
> (including EV) only.
> https://bugzilla.mozilla.org/show_bug.cgi?id=1311832
> 
> imo StartCom/WoSign won't be able to issue legitimate certificates for
> a while, but they can backdate just like they did before.

Mozilla are wise to that possibility:

| However, many eyes are on the Web PKI and if such additional back-dating is
| discovered (by any means), Mozilla will immediately and permanently revoke
| trust in all WoSign and StartCom roots.

See page 11 of:
https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/preview

The amazing list of wrong-doing documented by Mozilla doesn't give me
much confidence these CAs will fully mend their ways, even if they resist the
suicide of trying to back-date around the temporary ban.

If I had any certificates issued by either, I'd be looking to promptly replace
them with certificates from a different CA, partly so I didn't have to worry
that they might try back-dating and my certificates would stop being trusted,
but also who wants to do business with organisations like these?

Cheers,
    Olly