StartCom: un-revoking intermediate certificates

This case concerns StartCom certificates that were revoked and then later “un-revoked” by removing the revocation entries from CRL and updating OCSP so the certificates resumed returning “good.” The reporter (Mozilla) stated that this un-revoking was not permitted by the BRs, citing requirements that revocation entries on CRLs/OCSP must not be removed until after the revoked certificate’s expiry date and that the repository must not include entries indicating a certificate is suspended. StartCom explained that it had revoked cross-signed certificates after planning to cut its relationship with Wosign, but later received a message from Microsoft about an Azure issue attributed to the recently revoked Wosign certificates. StartCom said it decided to comply with Microsoft’s request to un-revoke the certificates because the “old” root certificates were distrusted on other platforms except Microsoft, while acknowledging that reinstating revoked certificates is against BRs and standards. Mozilla asked how to close the case and whether additional information was needed; the reporter indicated the situation was well understood and that no further information was required unless StartCom wished to add new details. The bug is marked RESOLVED with resolution FIXED.

1. 2017-06-01 StartCom revoked certain certificates and later removed their revocation status so CRL/OCSP returned “good” again.
2. 2017-09-21 Mozilla closed out the case as well understood without requesting additional information.

1. 2017-06-01 Mozilla representative — Reported that specific certificates were revoked and then un-revoked by removing CRL entries and updating OCSP, and stated un-revoking is not permitted by the BRs.
2. 2017-06-01 WoSign CA Limited — Explained StartCom’s remediation context involving Wosign cross-signed certificates and said Microsoft later requested un-revocation to fix an Azure issue.
3. 2017-09-20 Community commenter — Asked Gerv how to decide closure and whether the information-collection sufficiency matched the misissuance response pattern.
4. 2017-09-21 Mozilla representative — Agreed to let the case go, stating the situation was well understood unless StartCom provided additional information.