<story><title>Information on the revocation of WinRAR 5.91 digital certificate</title><url>https://www.rarlab.com/revoked591.html</url></story><parent_chain></parent_chain><comment><author>pimterry</author><text>&amp;gt; We think that revoking certificates based on questionable data discredits the certification system.&lt;p&gt;It&amp;#x27;s hard to dispute this imo. There are many good reasons certificates should be revoked, but the reasoning should be 100% public information, for both the vendor and users who may have trusted the original certificate.&lt;p&gt;I&amp;#x27;m building a desktop app, and the process to even get a certificate is absurd. Each CA has their own wildly different processes, and seemingly answers to nobody. I changed cert providers recently after Digicert suddenly raised their prices 400% on a whim, and it took a huge number of changing requirements, phone calls, 3rd parties, and over a month to receive the new one, despite already having an existing verified &amp;amp; still-valid signing certificate with all those details from an equally legitimate provider.&lt;p&gt;I&amp;#x27;d kill to see a modern service a la Let&amp;#x27;s Encrypt but for code signing. Something transparent, reliable, fast &amp;amp; trusted cross-platform (I can dream). Verifying identity is a hard problem, but it&amp;#x27;s really not _that_ hard a problem - there&amp;#x27;s plenty of fintech services that can reliably do sufficient KYC for banking in 5 minutes with a few id details and video call.</text></comment>
<story><title>Information on the revocation of WinRAR 5.91 digital certificate</title><url>https://www.rarlab.com/revoked591.html</url></story><parent_chain></parent_chain><comment><author>cm2187</author><text>I would have incremented the version number so the likes of Chocolatey would pick it up and replace the version installed with a revoked certificate as part of a regular update.</text></comment>