<story><title>WoSign Incidents Report Update [pdf]</title><url>https://www.wosign.com/report/WoSign_Incident_Report_Update_07102016.pdf</url></story><parent_chain></parent_chain><comment><author>terom</author><text>Awesome use of load balancing for request retry across multiple backend servers:&lt;p&gt;&amp;gt; This was caused by the CMS (Certificate Management System), when it sent the signing request of the certificate to the signing server A, which had no response, then the CMS sent it to the other newly added signing server B. After a while the signing server A signed the certificate and sent to the CMS and also to the subscriber, then the subscriber installed the cert in its website and hat&amp;#x27;s why Censys recorded this certificate; in the 
meantime, the signing server B also signed this certificate 
some time later (in seconds) and sent it to the CMS, the CMS accepted it and rewrote it in the DB.&lt;p&gt;&amp;gt; This issue happened after adding another signing server on Jan 5th 2015, and found it on April 9th 2015. When had the two signing servers added a load balancer, but the configuration was not properly done because it didn&amp;#x27;t lock the request.&lt;p&gt;Mind you, that&amp;#x27;s a perfectly legit technical bug. Maybe they were using nginx for load balancing POST requests? :)&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11217477&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11217477&lt;/a&gt;</text></comment>
<story><title>WoSign Incidents Report Update [pdf]</title><url>https://www.wosign.com/report/WoSign_Incident_Report_Update_07102016.pdf</url></story><parent_chain></parent_chain><comment><author>zamber</author><text>Cross linking the earlier WoSign scandal reports:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12389573&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12389573&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12582534&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12582534&lt;/a&gt;
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12617659&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=12617659&lt;/a&gt;&lt;p&gt;So if I get it right, WoSign will cease to exist as a CA given the 1y probation proposed by Mozilla and the general distrust that will follow?</text></comment>