WoSign and StartCom: Mozilla’s proposed conclusion
I think Mozilla is falling for Symantecs &#x2F; other CAs propaganda here. Yes, WoSign did bad things, but those are by far not the worst things we&#x27;ve seen in CA wrongdoings in the last years.
We&#x27;ve seen certs issued for MITM attacks and security holes in the validation process of nearly every CA. (<a href="http:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2012&#x2F;02&#x2F;14&#x2F;trustwave_analysis&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2012&#x2F;02&#x2F;14&#x2F;trustwave_analysis&#x2F;</a>) &lt; they confessed issuing a cert for MITM purpose and are still part of the game.
The allegations mainly consist of:
a) WoSign didn&#x27;t make transparent that they have control over StartCom. Yes, this is a thing and it should be discussed. But the main focus of this is obviously to get StartCom into this story. Where - as I understood it - there is no allegation, that StartCom itself did something wrong. At least not in the league of &quot;we should kill that company&quot;. Transparency is important and we should fight for it. Not only in China.
b) They backdated SHA-1 certs. Obviously because not updated Windows XP machines are a thing in China. This is against code of conduct. This is bad, but I totally get the intention here. And the intention is not MITM attacks or worse (as we see a lot in CA business) the intention is not to break Chinese internet.<p>Bottom line:
&quot;Let&#x27;s encrypt&quot; is destroying the business of many shady CAs these days. Competition is getting harder. StartCom had an advance in this race as they adopted quickly to the new rules and the&#x27;ve build the best product in the market for special use cases. We - for example - rely on a lot of wildcard certs for many domains. StartCom had the product. We pay&#x27;d them $200 for all our certs and the next cheapest competitor wanted $150.000 &#x2F; year for our certs. I totally get why they are getting attacked by the big players. I totally don&#x27;t get why Mozilla is falling for this.