On 10/04/2014 10:08, Peter Eckersley wrote:
Kaspar, suppose that Mozilla followed your suggestion and removed StartCom's root certificates from its trust store (or revoked them!). What would the consequences of that decision be, for the large number of domains that rely on StartCom certs?
The consequences would be that those domains would not be considered to be secure any longer. This is a good thing, not a bad thing. The certificates must be considered to be compromised if the domain was exposed to the Heartbleed Bug.
In order to act responsibly, StartCom must do one of the following: 1) make it possible for all their certificate holders (paid or not) to claim exposure to the bug and have the certificate revoked for that reason without charge, 2) revoke and reissue all active certificates issued by them, or 3) their root CA must be removed from all user agents.
Revocation must not require a fee; re-issuing can. That gives certificate holders the option to either re-issue using StartCom, or find another CA.
_______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
