Remove StartCom CA from Mozilla for violation of CA policy

The bug was filed to remove StartCom (StartCom) from Mozilla’s CA program, alleging a violation of Mozilla CA policy related to revocation of certificates believed to be compromised. The reporter stated that StartCom demanded additional payments, including from paying customers, to revoke certificates believed to be compromised. The reporter argued that revocation obligations under the Mozilla CA policy apply regardless of customer payments, and that charging may be acceptable for re-issuing but not for the revocation itself. Another participant pointed to bug 994033 and marked this bug as a duplicate. The bug’s resolution is listed as DUPLICATE, and the thread does not describe any separate remediation action by Mozilla or StartCom beyond the duplicate handling.

1. 2014-04-10 A bug was opened requesting removal of the StartCom CA from Mozilla’s CA program over alleged CA policy non-compliance regarding revocation.
2. 2014-04-10 The bug was marked as a duplicate of bug 994033.

1. 2014-04-10 Mtu representative — Reported that StartCom was in violation of Mozilla CA policy by demanding additional payments to revoke certificates believed to be compromised, and argued revocation should occur without such demands.
2. 2014-04-10 Mtu representative — Clarified the interpretation that StartCom’s revocation obligations apply regardless of payments, distinguishing revocation from re-issuance.
3. 2014-04-10 Kuix representative — Said the discussion belongs on the dev-security-policy mailing list and noted the bug was marked as a duplicate of bug 994033.
4. 2014-04-12 Community commenter — Shared an experiment URL related to revocation.
5. 2014-04-12 Community commenter — Commented that, based on StartCom’s reply, the internet can’t trust them anymore.
6. 2014-04-12 Disabled representative — Discussed the experiment in relation to StartCom’s policy and suggested it could trigger revocation and potential reimbursement issues.