StartCom

StartCom was a certificate authority founded in Eilat, Israel, and later based in Beijing, People's Republic of China, that had three main activities: StartCom Linux Enterprise (Linux distribution), StartSSL (certificate authority) and MediaHost (web hosting). StartCom set up branch offices in China, Hong Kong, the United Kingdom and Spain.[3] Due to multiple faults on the company's end, all StartCom certificates were removed from Mozilla Firefox in October 2016[4] and Google Chrome in March 2017, including certificates previously issued, with similar removals from other browsers expected to follow.[5]

StartCom Ltd.
Private company
IndustryInternet security, Public key infrastructure
Founded1999 (1999)
FounderEddy Nigg[1]
DefunctJanuary 1, 2018 (2018-01-01)[2]
Headquarters
Beijing
,
China
Area served
Worldwide
Key people
Iñigo Barreira (CEO), Tan Xiaosheng (Chairman), Yang Qing
OwnerQihoo 360 Group
ParentStartCom CA Ltd. (UK), StartCom CA Ltd. (HK)
Websitewww.startcom.org 

StartCom was acquired in secrecy[6] by WoSign Limited (Shenzen, Guangdong, People's Republic of China), through multiple companies,[lower-alpha 1] which was revealed by the Mozilla investigation[6] related to the root certificate removal of WoSign and StartCom in 2016. Due to the sanctions of both Mozilla and Apple,[7][8] the company announced it would be restructured during 2016 by WoSign parent Qihoo 360 Group, detaching StartCom from the scandal-affected WoSign and making it a subsidiary of Qihoo.[lower-alpha 2][9]

Despite attempts to distance itself from the controversy, on November 16, 2017, StartCom announced termination of business, and on January 1, 2018, stopped serving new certificates, effectively closing the company.[10][11] The StartSSL, StartCom, and StartCom CA websites now redirect to WoSign's shop page.

StartSSL

StartCom offered the free Class 1 X.509 SSL certificate "StartSSL Free", which works for webservers (SSL/TLS) as well as for E-mail encryption (S/MIME). It also offered Class 2 and 3 certificates as well as Extended Validation Certificates, where a comprehensive validation (with costs) was mandatory.

While certificates were free and unlimited for certain uses, there were limitations imposed unless an upgrade is purchased:

  • Three-year certificate validity
  • Certificate revocation requires a fee

In June 2011, the company suffered a network breach which resulted in StartCom suspending issuance of digital certificates and related services for several weeks.[12] The attacker was unable to use this to issue certificates (and StartCom was the only breached provider, of six, where the attacker was blocked from doing so).[13]

Trustworthiness

The StartSSL certificate was included by default in Mozilla Firefox 2.x and higher, in Apple Mac OS X since version 10.5 (Leopard), all Microsoft operating systems since 24 September 2009,[14][15] and Opera since 27 July 2010.[16] Since Google Chrome, Apple Safari and Internet Explorer use the certificate store of the operating system, all major browsers previously included support for StartSSL certificates.

On 30 September 2016, during the investigation on WoSign, Apple announced that their software will not accept certificates issued by one of the WoSign certificates after 19 September 2016, and said they will take further action on WoSign/StartCom trust anchors as the investigation progresses.[8]

On 24 October 2016, Mozilla announced on its security blog that, following its discovery of the purchase of StartCom by another Certificate Authority called WoSign during its investigation on numerous issues with that CA, and that both have failed to disclose this transaction,[17] Mozilla will stop trusting certificates that are issued after 21 October 2016 starting with Firefox 51.[18] On 1 November 2016, Google announced that it too would stop trusting certificates issued after 21 October 2016 starting with Chrome 56. Certificates issued before this date may continue to be trusted, for a time, but in subsequent Chrome releases, these exceptions will be reduced and ultimately removed.[19] On 30 November 2016, Apple products will block certificates from WoSign and StartCom root CAs if the "Not Before" date is on or after 1 Dec 2016 00:00:00 GMT/UTC.[20]

As of Version 57, Google Chrome will only trust WoSign/StartCom certificates that were issued to sites in the Alexa Top 1M list, and Chrome 58 will only trust those in the Alexa Top 500k.[21]

On 8 August 2017, Microsoft announced on its Windows Security blog that Windows 10 will not trust any new certificates from WoSign and StartCom after September 2017.[22]

Despite changes to the company's structure, StartCom did not see "any clear indication from the browsers that StartCom would be able to regain the trust" by the browser companies. Therefore, StartCom has halted the issuing of all certificates since January 1, 2018 and will terminate business completely by 2020 by revoking all issued certificates.[23]

Response to Heartbleed

On 13 April 2014, StartCom announced[24] a FAQ page[25] related to Heartbleed, a critical bug in OpenSSL estimated to have left 17% of the Internet's secure web servers vulnerable to data theft.

StartCom's policy was to charge $25 for each revoked certificate, and it refused to waive this fee in the case of certificates compromised due to Heartbleed, though some paying customers were granted a single free revocation.[26][27][28] This caused many to doubt StartCom's status as a certificate authority.[29] When provided with proof of a compromised certificate, StartCom refused to revoke the certificate for free, providing trust even after StartCom had learned that the certificate had been compromised.[30]

Controversies

In August 2016 it was reported that StartCom was sold to WoSign, a Chinese CA.[17][31][32] The original disclosure was taken down for legal reasons.[33] However, repostings of the original articles are still available.[31] The relationship is unclear, but it seems as if the StartCom technical infrastructure was being used by WoSign when they were caught issuing about a hundred[34] improperly validated SSL certificates, including a certificate for github.com.[17][35]

An investigation by Google and Mozilla found that WoSign knowingly and intentionally mis-issued certificates in order to circumvent browser restrictions and CA requirements. As a result, Google joined Mozilla and Apple and planned to distrust all WoSign and StartCom certificates beginning in 2017.[36] On July 17, 2017, an announcement was made about the restructuring of the company. It was announced that StartCom is now 100% managed by Qihoo 360, no StartCom employees are working on WoSign premises, audits have been made by external pen testers, and a new CMS system was developed.[37]

gollark: So now I'm making a slow JS version.
gollark: Well, I made the Rust port of FractalArt actually work yesterday.
gollark: I'll release it here once I finish the controls.
gollark: Yes, this is the "bias" control.
gollark: I can also bias it the other way.

See also

Footnotes
  1. Structure as of October 2016: WoSign CA Limited Hong-Kong → StartCom CA Limited (HK) → StartCom CA Limited (UK)
  2. Planned restructure as of October 2016, to be implemented throughout the end of 2016: through the company chain Qihoo 360 → Qifei Int'l Development Ltd. (HK) → StartCom CA Ltd. (HK), which owns 100% of StartCom (CH) and StartCom CA Ltd. (UK), which in turn owns StartCom Ltd. (Israel) and StartCom CA Ltd. (Spain)

References
  1. Chirgwin, Richard (10 Oct 2016). "Heads roll as Qihoo 360 moves to end WoSign, StartCom certificate row". The Register. Retrieved 2016-12-10.
  2. Nohe, Patrick (20 Nov 2017). "StartCom SSL Shutting Down as of January 1, 2018". Retrieved 6 Jun 2018.
  3. "About StartCom". The Register. Apr 26, 2016. Archived from the original on June 25, 2016. Retrieved June 7, 2016.
  4. https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/
  5. Adam C. Engst. "Why Take Control Was Briefly Labeled "Not Secure"". Take Control.
  6. Mozilla (2016-10-10). "WoSign and StartCom". Retrieved 2016-10-25.
  7. apple (2016-09-30). "Blocking Trust for WoSign CA Free SSL Certificate G2 (IOS)".
  8. apple (2016-09-30). "Blocking Trust for WoSign CA Free SSL Certificate G2 (MacOS)".
  9. Qihoo 360 Group (2016-10-14). "StartCom Remediation Plan" (PDF). Archived from the original (PDF) on 2016-10-26. Retrieved 2016-10-25.
  10. "StartSSL™ Certificates & Public Key Infrastructure". www.startcomca.com. Retrieved 2017-11-17.
  11. 谭晓生 (17 November 2017). "Termination of the certificates business of Startcom". mozilla.dev.security.policy (Mailing list).
  12. "Web authentication authority suffers security breach". The Register. June 26, 2011. Retrieved January 14, 2012.
  13. "How StartCom Foiled Comodohacker: 4 Lessons". InformationWeek. September 8, 2011. Archived from the original on January 3, 2013. Retrieved December 20, 2012.
  14. "Microsoft Adds Support for StartCom Certificates". StartCom.org. September 24, 2009. Archived from the original (Press release) on July 17, 2011. Retrieved 2011-01-14.
  15. "Microsoft updates trusted root certs to include StartCom". Sophos.com Naked Security blog. September 27, 2009.
  16. "New Roots, new EV, and a new Public Suffix file". Opera.com Rootstore blog.
  17. "CA:WoSign Issues - MozillaWiki". Retrieved 2016-10-25.
  18. "Distrusting New WoSign and StartCom Certificates". October 24, 2016. Retrieved 2016-10-25.
  19. "Distrusting WoSign and StartCom Certificates". Google Online Security Blog. Retrieved 2016-11-02.
  20. "Lists of available trusted root certificates in iOS". Apple Support Web Site. Retrieved 2016-12-01.
  21. "685826 - Restrict the set of domains for WoSign/StartCom certificates - chromium - Monorail". bugs.chromium.org. Retrieved 2017-04-28.
  22. "Microsoft to remove WoSign and StartCom certificates in Windows 10". Windows Security. Retrieved 2017-08-11.
  23. "Termination of StartCom business". www.startcomca.com. Retrieved 2017-12-03.
  24. "Twitter / startssl: We released a small FAQ page ..." StartCom. 13 April 2014.
  25. "Heartbleed F.A.Q." StartCom. 13 April 2014.
  26. "I use StartCom, and I revoked and re-keyed yesterday. In the revocation reason, ... Hacker News". Geoff. 9 April 2014.
  27. "Twitter / codeawe: @tonylampada @startssl ..." J. Breitsprecher. 11 April 2014.
  28. "Re: OpenSSL CVE-2014-0160 (aka "Heartbleed")". Jan. 9 April 2014. Archived from the original on 13 April 2014.
  29. "Most StartSSL certs will stay compromised". 9 April 2014.
  30. "StartSSL, please revoke me!". 12 April 2014. Archived from the original on April 12, 2014.CS1 maint: unfit url (link)
  31. "Thoughts and Observations: WoSign's secret purchase of StartCom; WoSign threatened legal actions over the disclosure". www.percya.com. Archived from the original on 2016-09-05. Retrieved 2016-09-08.
  32. "Thoughts and Observations: StartCom operated solely by WoSign in China - an analysis of the new StartCom website". www.percya.com. Archived from the original on 2016-09-07. Retrieved 2016-09-08.
  33. https://letsphish.org
  34. https://groups.google.com/d/topic/mozilla.dev.security.policy/k9PBmyLCi8I/discussion
  35. "The story of how WoSign gave me an SSL certificate for GitHub.com".
  36. Seals, Tara (November 2, 2016). "Google to Distrust WoSign/StartCom Certificates". InfoSecurity Magazine. Retrieved July 7, 2017.
  37. "1311832 - StartCom: Action Items". bugzilla.mozilla.org. Retrieved 2017-08-01.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.