← Start Commercial (StartCom) Ltd. cases
Bugzilla #471702
Ca Security Vulnerability
Security Incident
StartCom's key for bogus www.mozilla.com certificate should be destroyed
RESOLVED
INVALID
Start Commercial (StartCom) Ltd.
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
This case involves StartCom's issuance of a certificate for www.mozilla.com, which was obtained under questionable circumstances by Eddy Nigg, who claimed to expose validation failures at a competitor CA. The certificate was installed on a publicly accessible server, and Nigg threatened to publish the private key. The thread discusses the implications of this incident, including calls for the destruction of the private key. Ultimately, the bug was resolved with the status 'INVALID', as it was determined that Mozilla could not compel the destruction of the key, although it was noted that Nigg had taken down the server hosting the certificate.
Chronology
- StartCom's certificate for www.mozilla.com was obtained under questionable circumstances.
Thread Activity
- Samj representative — Reported that StartCom's certificate for www.mozilla.com was fraudulently obtained.
- Startcom representative — Claimed the issue was resolved to Mozilla's satisfaction and left it to Mozilla to close the bug.
- Mozilla representative — Stated that the request to destroy the private key could not be compelled, leading to the bug's invalidation.
Participants
Samj representative
Startcom representative
Mozilla representative
Anode representative
External References
Related Bugzilla IDs Mentioned
Similar Local Cases
Clarification requested regarding remediation of StartCom certificate issuance vulnerability
StartCom StartEncrypt vulnerability allowed issuance of fraudulent google.com, dropbox.com, etc certificates
DigiCert: OCSP responder returning invalid responses
DigiCert: Private Keys Disclosed by Customers as Part of CSR
HARICA: Anomaly in OCSP services after CA software upgrade
DigiCert: Issuance of certs with weak keys (ROCA)
DigiCert: OCSP not responding issue
DigiCert: 4 CRLs unavailable or not responding