The browser-trusted WoSign authority intentionally back-dated certificates it has issued over the past nine months to avoid an industry-mandated ban on the use of the SHA-1 hashing algorithm

[...]

hey also accused WoSign of improperly concealing its acquisition of Israeli certificate authority StartCom, which was used to issue at least one of the improperly issued certificates.

[...]

"Taking into account all the issues listed above, Mozilla's CA team has lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA," Monday's report stated. "Therefore we propose that, starting on a date to be determined in the near future, Mozilla products will no longer trust newly issued certificates issued by either of these two CA brands."

WoSign's practices came under scrutiny after an IT administrator for the University of Central Florida used the service to obtain a certificate for med.ucf.edu. He soon discovered that he mistakenly got one for www.ucf.edu. To verify that the error wasn't isolated, the admin then used his control over the github subdomains schrauger.github.com and schrauger.github.io to get certificates for github.com, github.io, and www.github.io. When the admin finally succeeded in alerting WoSign to the improperly issued Github certificates, WoSign still didn't catch the improperly issued www.ucf.edu certificate and allowed it to remain valid for more than a year. For reasons that aren't clear, Mozilla's final report makes no explicit mention the certificates involving the Github or UCF domains, which were documented here in August.

[...]

WoSign built a system where applicants could add extra arbitrary domains to their certificates before issuance. Even when mis-issuances happened they did not determine the root cause and eliminated the flaw only in an unrelated system upgrade.

[...]

WoSign has an “issue first, validate later” process where it is acceptable to detect mis-issued certificates during validation the next working day and revoke them at that point.

[...]

The level of understanding of the certificate system by their engineers, and the level of quality control and testing exercised over changes to their systems, leaves a great deal to be desired. It does not seem they have the appropriate cultural practices to develop secure and robust software.

[...]

For reasons which still remain unclear, WoSign appeared determined to hide the fact that they had purchased StartCom, actively misleading Mozilla and the public about the situation.

[...]

WoSign’s auditors, Ernst & Young (Hong Kong), have failed to detect multiple issues they should have detected. (Issue J, Issue X)

Mozilla envisage de ne plus faire confiance aux nouveaux certificats émis par l'AC chinoise WoSign (qui a racheté StartCom) au-delà d'une date qui n'est pas encore fixée. La mesure vaudra pour un an minimum avant que cette AC soit autorisée à repasser la certification de Mozilla si elle a procédé à des changements drastiques dans ses process.

Le monde des autorités de certification x509 est toujours aussi sérieux… :'( Certificats x509 auto-signés + DNSSEC + DANE partout et basta.

Via FRsAG.