Type Private company Area served Worldwide Founder Eddy Nigg | Headquarters Beijing, China Owner Qihoo 360 Group Founded 1999 | |
 | ||
Industry Internet security, Public key infrastructure Key people Iñigo Barreira (CEO), Tan Xiaosheng (Chairman), Yang Qing | ||
StartCom is a certificate authority based in Eilat, Israel, that has three main activities: StartCom Linux Enterprise (Linux distribution), StartSSL (certificate authority) and MediaHost (web hosting). StartCom has set up new branch offices in China, Hong Kong, the United Kingdom and Spain.
Contents
- Taking a look at startcom linux part 2
- StartSSL
- Trustworthiness
- Limitations of StartSSL Unlimited Free Certificates
- Response to Heartbleed
- Criticism
- References
StartCom was acquired in secrecy by WoSign Limited (Shenzen, China), through multiple companies, which was revealed by the Mozilla investigation related to the root certificate removal of WoSign and StartCom in 2016. Due to the sanctions of both Mozilla and Apple the companies will be restructured (within 2016) by the owner company of WoSign: Qihoo 360 Group (Beijing); the new structure will detach StartCom from the scandal-affected WoSign and put it under Qihoo 360 as a 100% subordinate company.
Taking a look at startcom linux part 2
StartSSL
StartCom offers the free Class 1 X.509 SSL certificate "StartSSL Free", which works for webservers (SSL/TLS) as well as for E-mail encryption (S/MIME). It also offers Class 2 and 3 certificates as well as Extended Validation Certificates, where a comprehensive validation (with costs) is mandatory.
In June 2011, the company suffered a network breach which resulted in StartCom suspending issuance of digital certificates and related services for several weeks. The attacker was unable to use this to issue certificates (and StartCom was the only breached provider, of six, where the attacker was blocked from doing so).
Trustworthiness
The StartSSL certificate is included by default in Mozilla Firefox 2.x and higher, in Apple Mac OS X since version 10.5 (Leopard), all Microsoft operating systems since 24 September 2009, and Opera since 27 July 2010. Since Google Chrome, Apple Safari and Internet Explorer use the certificate store of the operating system, all major browsers include support for StartSSL certificates.
On 30 September 2016, during the investigation on WoSign, Apple announced that their software will not accept certificates issued by one of the WoSign certificates after 19 September 2016, and said they will take further action on WoSign/StartCom trust anchors as the investigation progresses.
On 24 October 2016, Mozilla announced on its security blog that, following its discovery of the purchase of StartCom by another Certificate Authority called WoSign during its investigation on numerous issues with that CA, and that both have failed to disclose this transaction, Mozilla will stop trusting certificates that are issued after 21 October 2016 starting with Firefox 51. On 1 November 2016, Google announced that it too would stop trusting certificates issued after 21 October 2016 starting with Chrome 56. On 30 November 2016, Apple products will block certificates from WoSign and StartCom root CAs if the "Not Before" date is on or after 1 Dec 2016 00:00:00 GMT/UTC.
Limitations of StartSSL Unlimited Free Certificates
While certificates are free and unlimited for certain uses, there are limitations imposed unless an upgrade is purchased:
Response to Heartbleed
On 13 April 2014, StartCom announced a FAQ page related to Heartbleed, a critical bug in OpenSSL estimated to have left 17% of the Internet's secure web servers vulnerable to data theft.
StartCom's policy is to charge $25 for each revoked certificate, and it refused to waive this fee in lieu of certificates compromised due to Heartbleed, though some paying customers were granted a single free revocation. This caused many to doubt StartCom's status as a certificate authority. When provided with proof of a compromised certificate, StartCom refused to revoke the certificate for free, providing trust even after StartCom had learned that the certificate had been compromised.
Criticism
In August 2016 it was reported that StartCom was sold to WoSign, a Chinese CA. The original disclosure was taken down for legal reasons. However, repostings of the original articles are still available. The relationship is unclear, but it seems as if the StartCom technical infrastructure was being used by WoSign when they were caught issuing about a hundred improperly validated SSL certificates, including a certificate for github.com.