WoSign has posted an announcement regarding Mozilla's decision. In the announcement, WoSign stated
WoSign actively cooperated with the investigation and has always fix all the issues immediately after the discovery and called Mozilla's decision "exceptionally severe". Certs issued by existing WoSign roots will be 90% off from Oct 22nd. WoSign will launch a new WoSign intermediate cert to continue to sell certs trusted by all browsers including Firefox. The intermediate cert will be signed by another trusted root CA. This is scheduled to launch within a month. ----- The full announcement is translated below. https://www.wosign.com/news/announcement_about_Mozilla_Action_20161024.htm Announcements about the Mozilla Incident Release Date: 2016-10-24 Mozilla on August 24 launched an investigation against WoSign CA, and published a list of questions ( Wiki ), lists all the issues from March 2015 to July 2016 period. WoSign addressed these issues with a careful investigation and released the investigation report , some issues have been clarified and all issues have been fixed immediately after their discovery. WoSign actively cooperated with the investigation and argued for the best interests of users, to ensure that the certificate issued previously will not be affected. Mozilla has released on the October 21, the final response to WoSign. WoSign has the following statement regarding this incident 1.the results of the incident Very sorry to see Mozilla decided from October 22 onwards no longer trust the four WoSign root certificate; After June 1, 2017, after satisfying Mozilla's 6-point operational requirements, WoSign CA can re-apply for the Mozilla root certification process, re-apply for a new root certificate inclusion. 2. the impact of the incident on the user All SSL certificates October 21 (including 21), before issuing are not affected, can normally be trusted by Mozilla Firefox browser ; after October 21 SSL certs from WoSign (WoSign) 4 root certificate will not be trusted by Firefox. All code-signing certificates, client certificates, and signature platforms (WoSignDoc) issued from the four WoSign roots are unaffected. 3. WoSign’s response measures after the incident Will update the digital certificate Store Buy website. From October 22, all SSL certificates from WoSign four root certificate will be 90% off; free SSL certificate service continue to be closed; Will add a product option, the user can choose to support all browsers SSL Certificates (including Firefox) under the new WoSign (WoSign) intermediate root certificates issued during the transitional period 20% Off! This intermediate root certificate will be issued by other CA root certificates that are trusted globally, supporting all browsers and all new and existing terminal devices. The product upgrade plan is scheduled to completed within one month and provide a certificate for the majority of users; Will be actively in accordance with the requirements of Mozilla-made 6 points for operation, for after June 1, 2017, as soon as possible to complete the new root certificate in the various browser system preset work; Has been and continue to conduct a comprehensive security audit of all systems and strengthen the upgrading, while improving the various internal control management system, the formation of international standards research team and internal audit team to ensure that all systems 100% meet international standards, all business operations in strict accordance with international standards. Require operation, strengthen the staff in strict accordance with the standard operation of the enforcement efforts, offenders will be severely punished. Mozilla's sanctions are exceptionally severe, but we will sincerely accept and carry out profound reflection and improvement, continue to improve system reliability, security and compliance, strict compliance with various international standards and various browser vendors designated security management strategy. We know that: as a Chinese CA's international road is still very long, but WoSign’s plan to build world-class PKI certificate service at the beginning will stay the same! We will continue to contribute to building a safe and trusted global Internet environment, and actively promote the PKI / CA-related Chinese standards and international standards system integration. Thank you very much for your continued trust in the majority of users and partners! It is with your support and companionship, WoSign has gone through ten years of wind and rain, and achieved SSL certificate in China market share of nearly 50% and the global market ranked sixth in the good results, we hope to continue with your towards the next more brilliant decade! _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
