Your message dated Sun, 05 Oct 2014 20:48:02 -0500
with message-id <[email protected]>
and subject line Re: Bug#744027: Please remove StartCom Certification Authority
root certificate
has caused the Debian Bug report #744027,
regarding Please remove StartCom Certification Authority root certificate
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
744027: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744027
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ca-certificates
Following the OpenSSL CVE-2014-0160 "Heartbleed" vulnerability [1,2],
any certificate that was used with an vulnerable version of OpenSSL (I
read somewhere 1/3 of the web) should be handled as it is compromised.
Compromised certificates have to be replaced with new ones (new keys)
and the old ones should be revoked.
StartCom provides cheap and even free SSL certificates via the
StartSSL brand. However, certificates revoking cerificates requires a
US$ 24.90 fee [3]. This discourages responsible sysadmin procedure and
and will ensure many compromised certificates remain in use. As a
consequence you can't trust certificates signed by StartCom before
2014-04-07.
Solution 1: StartCom should revoke affected certs. (unlikely[4-6])
Solution 2: StartCom should be removed from the truststore.
See also: https://bugzilla.mozilla.org/show_bug.cgi?id=994033
[1] https://www.openssl.org/news/secadv_20140407.txt
[2] http://heartbleed.com/
[3] http://www.startssl.com/?app=25#72
[4] https://news.ycombinator.com/item?id=7557764
[5] https://twitter.com/startssl/status/453583493386485760
[6] https://twitter.com/startssl/status/453631038883758080
Solution 2: StartCom should be removed from the truststore.
--- End Message ---
--- Begin Message ---
Closing bug.
--- End Message ---
