{"id":2136,"date":"2016-10-24T18:05:20","date_gmt":"2016-10-25T01:05:20","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2136"},"modified":"2016-10-25T02:02:52","modified_gmt":"2016-10-25T09:02:52","slug":"distrusting-new-wosign-and-startcom-certificates","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/","title":{"rendered":"Distrusting New WoSign and StartCom Certificates"},"content":{"rendered":"<p>Mozilla has discovered that a <a href=\"https:\/\/wiki.mozilla.org\/CA:FAQ\" target=\"_blank\">Certificate Authority<\/a> (CA) called WoSign has had a <a href=\"https:\/\/wiki.mozilla.org\/CA:WoSign_Issues\" target=\"_blank\">number of technical and management failures<\/a>. Most seriously, we <a href=\"https:\/\/docs.google.com\/document\/d\/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ\/edit?usp=sharing\" target=\"_blank\">discovered<\/a> they were <a href=\"https:\/\/wiki.mozilla.org\/CA:WoSign_Issues#Issue_S:_Backdated_SHA-1_Certs_.28January_2016.29\" target=\"_blank\">backdating<\/a> SSL certificates in order to get around the <a href=\"https:\/\/mozillacaprogram.secure.force.com\/Communications\/CommunicationActionOptionResponse?CommunicationId=a04o000000M89RCAAZ&amp;Question=ACTION%20%233:%20After%20January%201,%202016\" target=\"_blank\">deadline<\/a> that CAs stop issuing SHA-1 SSL certificates by January 1, 2016. Additionally, Mozilla <a href=\"https:\/\/groups.google.com\/d\/msg\/mozilla.dev.security.policy\/0pqpLJ_lCJQ\/z69lmZ88DwAJ\" target=\"_blank\">discovered<\/a> that WoSign had acquired full ownership of another CA called StartCom and failed to disclose this, as required by Mozilla policy. The representatives of WoSign and StartCom denied and continued to deny both of these allegations until sufficient data was collected to demonstrate that both allegations were correct. The levels of deception demonstrated by representatives of the combined company have led to Mozilla\u2019s decision to distrust future certificates chaining up to the currently-included WoSign and StartCom root certificates.<\/p>\n<p>Specifically, Mozilla is taking the following actions:<\/p>\n<ol>\n<li>Distrust certificates with a notBefore date after October 21, 2016 which chain up to the following affected roots. If additional back-dating is discovered (by any means) to circumvent this control, then Mozilla will immediately and permanently revoke trust in the affected roots.\n<ul>\n<li>This change will go into the <a href=\"https:\/\/wiki.mozilla.org\/RapidRelease\/Calendar\" target=\"_blank\">Firefox 51 release train<\/a>.<\/li>\n<li>The code will use the following <a href=\"https:\/\/en.wikipedia.org\/wiki\/X.500#X.500_data_models\" target=\"_blank\">Subject Distinguished Names<\/a> to identify the root certificates, so that the control will also apply to <a href=\"https:\/\/en.wikipedia.org\/wiki\/X.509#Certificate_chains_and_cross-certification\" target=\"_blank\">cross-certificates<\/a> of these roots.\n<ul>\n<li>CN=CA \u6c83\u901a\u6839\u8bc1\u4e66, OU=null, O=WoSign CA Limited, C=CN<\/li>\n<li>CN=Certification Authority of WoSign, OU=null, O=WoSign CA Limited, C=CN<\/li>\n<li>CN=Certification Authority of WoSign G2, OU=null, O=WoSign CA Limited, C=CN<br \/>\nCN=CA WoSign ECC Root, OU=null, O=WoSign CA Limited, C=CN<\/li>\n<li>CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL<\/li>\n<li>CN=StartCom Certification Authority G2, OU=null, O=StartCom Ltd., C=IL<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Add the previously identified <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1309707#c2\" target=\"_blank\">backdated SHA-1 certificates<\/a> chaining up to these affected roots to <a href=\"https:\/\/blog.mozilla.org\/security\/2015\/03\/03\/revoking-intermediate-certificates-introducing-onecrl\/\" target=\"_blank\">OneCRL<\/a>.<\/li>\n<li>No longer accept audits carried out by Ernst &amp; Young Hong Kong.<\/li>\n<li>Remove these affected root certificates from <a href=\"https:\/\/wiki.mozilla.org\/CA:Overview\" target=\"_blank\">Mozilla\u2019s root store<\/a> at some point in the future. If the CA&#8217;s new root certificates are accepted for <a href=\"https:\/\/wiki.mozilla.org\/CA:How_to_apply\" target=\"_blank\">inclusion<\/a>, then Mozilla may coordinate the removal date with the CA\u2019s plans to migrate their customers to the new root certificates. Otherwise, Mozilla may choose to remove them at any point after March 2017.<\/li>\n<li>Mozilla reserves the right to take further or alternative action.<\/li>\n<\/ol>\n<p>If you receive a certificate from one of these two CAs after October 21, 2016, your certificate will not validate in Mozilla products such as <a href=\"https:\/\/wiki.mozilla.org\/RapidRelease\/Calendar\" target=\"_blank\">Firefox 51 and later<\/a>, until these CAs provide new root certificates with different Subject Distinguished Names, and you <a href=\"https:\/\/wiki.mozilla.org\/CA:UserCertDB#Importing_a_Root_Certificate\" target=\"_blank\">manually import<\/a> the root certificate that your certificate chains up to. Consumers of your website will also have to manually import the new root certificate until it is included by default in Mozilla\u2019s root store.<\/p>\n<p>Each of these CAs may re-apply for inclusion of new (replacement) root certificates as described in <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1311824\" target=\"_blank\">Bug #1311824<\/a> for WoSign, and <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1311832\" target=\"_blank\">Bug #1311832<\/a> for StartCom.<\/p>\n<p>We believe that this response is consistent with Mozilla policy and is one which we could apply to any other CA that demonstrated similar levels of deception to circumvent <a href=\"https:\/\/www.mozilla.org\/en-US\/about\/governance\/policies\/security-group\/certs\/policy\/\" target=\"_blank\">Mozilla\u2019s CA Certificate Policy<\/a>, the <a href=\"https:\/\/cabforum.org\/baseline-requirements-documents\/\" target=\"_blank\">CA\/Browser Forum\u2019s Baseline Requirements<\/a>, and direct inquiries from Mozilla representatives.<\/p>\n<p>Mozilla Security Team<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mozilla has discovered that a Certificate Authority (CA) called WoSign has had a number of technical and management failures. Most seriously, we discovered they were backdating SSL certificates in order &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/\">Read more<\/a><\/p>\n","protected":false},"author":581,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45538,69],"tags":[],"coauthors":[45544],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Distrusting New WoSign and StartCom Certificates - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kathleen Wilson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/\",\"name\":\"Distrusting New WoSign and StartCom Certificates - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2016-10-25T01:05:20+00:00\",\"dateModified\":\"2016-10-25T09:02:52+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Distrusting New WoSign and StartCom Certificates\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063\",\"name\":\"Kathleen Wilson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8d4547801f543f8990aecbcfc9c18eca\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g\",\"caption\":\"Kathleen Wilson\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Distrusting New WoSign and StartCom Certificates - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/","twitter_misc":{"Written by":"Kathleen Wilson","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/","url":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/","name":"Distrusting New WoSign and StartCom Certificates - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2016-10-25T01:05:20+00:00","dateModified":"2016-10-25T09:02:52+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2016\/10\/24\/distrusting-new-wosign-and-startcom-certificates\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Distrusting New WoSign and StartCom Certificates"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063","name":"Kathleen Wilson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8d4547801f543f8990aecbcfc9c18eca","url":"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g","caption":"Kathleen Wilson"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2136"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/581"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2136"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2136\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2136"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}