Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

> not doing verification? Could you say more about that? > And how do you know there is a manual audit about this? I issued a certificate even if it is free, but still passed the audit,follow-up notice to my mailbox,I know the reason for the manual audit is because the email notification to me.

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

On Wednesday, December 14, 2016 at 8:29:24 PM UTC-8, zbw...@gmail.com wrote: > 在 2016年12月15日星期四 UTC+8上午9:53:29，Percy写道： > > lslqtz, > > Could you host a subdomain say wosign.loliwiki.org with this cert? So we > > can test the blocking is functioning correctly. > > I was pulled into the black

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

在 2016年12月15日星期四 UTC+8上午9:53:29，Percy写道： > lslqtz, > Could you host a subdomain say wosign.loliwiki.org with this cert? So we can > test the blocking is functioning correctly. I was pulled into the black list. ___ dev-security-policy mailing list

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

lslqtz, Could you host a subdomain say wosign.loliwiki.org with this cert? So we can test the blocking is functioning correctly. ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org

RE: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

-dev-security-pol...@lists.mozilla.org Subject: Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it. If you made a promise to close it "due to some security consideration", then you don't have the right to just enable and disable it at will,

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

If you made a promise to close it "due to some security consideration", then you don't have the right to just enable and disable it at will, or disable it at one channel but not another channel, which ultimately has the same security if WoSign is doing the validation. On Sunday, December 11,

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

在 2016年12月10日星期六 UTC+8上午9:34:50，zbw...@gmail.com写道： > 在 2016年12月6日星期二 UTC+8上午6:50:04，Percy写道： > > lslqtz, > > How did you obtain this certificate from WoSign? Through the public website > > or some other means? > > I get this certificate through the dealer's website, but the dealer and > WoSign

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

As I said, we have the right to keep it or close it at any time. Best Regards, Richard > On 11 Dec 2016, at 12:47, Percy wrote: > >> On Saturday, December 10, 2016 at 8:29:29 PM UTC-8, Richard Wang wrote: >> Our promise is close the free SSL application in our own

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

On Saturday, December 10, 2016 at 8:29:29 PM UTC-8, Richard Wang wrote: > Our promise is close the free SSL application in our own website: > buy.wosign.com. > > And now we closed it in our PKI side. > > > Best Regards, > > Richard > > > On 9 Dec 2016, at 04:17, Gervase Markham

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

Our promise is close the free SSL application in our own website: buy.wosign.com. And now we closed it in our PKI side. Best Regards, Richard > On 9 Dec 2016, at 04:17, Gervase Markham wrote: > >> On 05/12/16 13:41, Richard Wang wrote: >> We checked our system, this order

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

As I said before, you finished the domain validation. This is DV SSL that no need to do the manual validation. Best Regards, Richard > On 10 Dec 2016, at 09:33, "zbw...@gmail.com" wrote: > > 在 2016年12月6日星期二 UTC+8上午6:50:04，Percy写道： >> lslqtz, >> How did you obtain this

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

在 2016年12月6日星期二 UTC+8上午6:50:04，Percy写道： > lslqtz, > How did you obtain this certificate from WoSign? Through the public website > or some other means? I get this certificate through the dealer's website, but the dealer and WoSign API are not doing the verification, the final manual audit also

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

在 2016年12月9日星期五 UTC+8上午4:19:31，Gervase Markham写道： > On 05/12/16 13:41, Richard Wang wrote: > > We checked our system, this order is from one of the reseller. We > > have many resellers that used the API, we noticed all resellers to > > close the free SSL, but they need some time to update the

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

On 05/12/16 13:41, Richard Wang wrote: > We checked our system, this order is from one of the reseller. We > have many resellers that used the API, we noticed all resellers to > close the free SSL, but they need some time to update the system. More than two months? Has this reseller given a

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

Sorry, we don't have deadline. And no plan to close it in PKI side, we keep the right to active it at any time, and we can issue this free SSL certificate for subscribers at any time if customers need it. Best Regards, Richard > On 6 Dec 2016, at 07:49, Percy wrote: >

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

When I was trying to inform Apple to put a time constrain on the intermediate CA, you implied such constrain not necessary because no new certs will be issued. Clearly, you know already that the users can still get certs from reseller and potentially abuse it due to all the control failures

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

We checked our system, this order is from one of the reseller. We have many resellers that used the API, we noticed all resellers to close the free SSL, but they need some time to update the system. The most important thing is this certificate is issued by proper way that this subscriber

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

在 2016年12月5日星期一 UTC+8下午9:06:13，lslqtz写道： > Certificate: > -BEGIN CERTIFICATE- > MIIFwTCCBKmgAwIBAgIQH6W3+xfuFD8074LcZJFjLjANBgkqhkiG9w0BAQsFADBP > MQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIExpbWl0ZWQxJDAiBgNV > BAMMG0NBIOayg+mAmuWFjei0uVNTTOivgeS5piBHMjAeFw0xNjEyMDUwNTU4NDJa >

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

WoSign is actively deceiving this community again. In Nov. 13th, in the thread Apple's response to the WoSign incidents, I stated that "CA 沃通免费SSL证书 G2", the intermediate CA of this certificate should be time constrained by Apple. But Richard stated that "WoSign stopped to issue free SSL

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

lslqtz, How did you obtain this certificate from WoSign? Through the public website or some other means? ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy

Re: In September 29, 2016, WoSign stop issuing free certificate, but I still successfully get it.

On the WoSign website https://buy.wosign.com/free/?lan=en , it clearly states that "Sorry, due to some security consideration, WoSign decide to close the free SSL certificate application temporarily. Sept. 29th 2016." ___ dev-security-policy mailing

In September 29, 2016,WoSign stop issuing free certificate,but I still successfully get it.

Certificate: -BEGIN CERTIFICATE- MIIFwTCCBKmgAwIBAgIQH6W3+xfuFD8074LcZJFjLjANBgkqhkiG9w0BAQsFADBP MQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIExpbWl0ZWQxJDAiBgNV BAMMG0NBIOayg+mAmuWFjei0uVNTTOivgeS5piBHMjAeFw0xNjEyMDUwNTU4NDJa