<story><title>23,000 HTTPS certificates axed after CEO e-mails private keys</title><url>https://arstechnica.com/information-technology/2018/03/23000-https-certificates-axed-after-ceo-e-mails-private-keys/</url></story><parent_chain></parent_chain><comment><author>DyslexicAtheist</author><text>Oops Trustico server allows arbitrary RCE incl root shell: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;svblxyz&amp;#x2F;status&amp;#x2F;969220402768736258&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;svblxyz&amp;#x2F;status&amp;#x2F;969220402768736258&lt;/a&gt;&lt;p&gt;see also &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;groups.google.com&amp;#x2F;forum&amp;#x2F;#!topic&amp;#x2F;mozilla.dev.security.policy&amp;#x2F;BLvabFwcJqo&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;groups.google.com&amp;#x2F;forum&amp;#x2F;#!topic&amp;#x2F;mozilla.dev.security...&lt;/a&gt;</text></comment>
<story><title>23,000 HTTPS certificates axed after CEO e-mails private keys</title><url>https://arstechnica.com/information-technology/2018/03/23000-https-certificates-axed-after-ceo-e-mails-private-keys/</url></story><parent_chain></parent_chain><comment><author>tialaramex</author><text>A question I still have is what Trustico _hoped_ was going to happen here. Was there some arrangement where if the certs have to be revoked they get a refund?&lt;p&gt;Trustico also don&amp;#x27;t seem very clear on what exactly they&amp;#x27;re accusing Symantec of, the Ars article quotes them&lt;p&gt;&amp;quot;We believe Symantec to have operated our account in a manner whereby it had been compromised&amp;quot; and &amp;quot;We believe the orders placed via our Symantec account were at risk and were poorly managed&amp;quot;&lt;p&gt;In the relationship we&amp;#x27;re talking about here, a reseller to a CA, basically the only valuable information that can be compromised is payment instructions. All the important seeming cryptographic stuff? All of that is allowed to be public by design, the CSR, the Certificates themselves, any validation messages used - all public thanks to asymmetric cryptography.&lt;p&gt;Symantec got in trouble last year for inadequate (in fact basically non-existent) oversight of their RAs, particularly the Korean CrossCert. Unlike a reseller the RAs were trusted to do the domain validation themselves, so if CrossCert said &amp;quot;We checked and it&amp;#x27;s OK to issue a Thawte cert for www.example.com with this key&amp;quot; then Symantec just did it and didn&amp;#x27;t ask any questions (though they do seem to have checked they got paid...). Resellers aren&amp;#x27;t trusted with validation, they&amp;#x27;re just glorified sales people who just take a cut and help with price discrimination, what&amp;#x27;s there to &amp;quot;compromise&amp;quot; months after you cease the relationship?</text></comment>