← Start Commercial (StartCom) Ltd. cases
Bugzilla #1311832
Ca Certificate Compliance
Self Reported Incident
StartCom: Action Items
RESOLVED
INCOMPLETE
Start Commercial (StartCom) Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves StartCom Ltd. disclosing a series of action items required to regain trust in Mozilla products after a compliance failure. Following a decision communicated in Bug #1309707, new certificates issued after October 21, 2016, that chain to certain StartCom certificates would no longer be trusted. StartCom outlined a remediation plan that includes implementing changes to ensure compliance with Mozilla's CA Certificate Policy and the CA/Browser Forum's Baseline Requirements. The CA must complete several steps, including updating their Certificate Policy, conducting audits, and ensuring proper Certificate Transparency logging. The current status of the bug is resolved, indicating that the necessary actions have been addressed.
Chronology
- StartCom outlines action items to regain trust in Mozilla products.
Thread Activity
- Mozilla representative — StartCom must implement changes to ensure compliance with Mozilla's policies.
- WoSign CA Limited — StartCom updates the bug to indicate they have applied for inclusion in Mozilla again.
- Mozilla representative — The requirements have been communicated to StartCom, and the bug is currently not actionable.
Participants
Mozilla representative
WoSign CA Limited
External References
Similar Local Cases
Camerfirma: Startcom are issuing by proxy using Camerfirma
StartCom: OCSP responder often returns "unknown" for recently-issued certificates
DigiCert / Justica: Invalid DNS names
Let's Encrypt: Attacker-controlled google.tg certificate being used in the wild.
NetLock: Non-BR-Compliant Certificate Issuance
DigiCert / Telecom Italia: Several Problems
DigiCert: Verizon mis-issued test certificates
StartCom: mis-issuance of certs with unvalidated domain names and bogus field values