Geotrust/Symantec has revoked all SSL certificates for .pw domains

Could this be anything like the DigiNotar hack?[0]<p>If it came out that Symantec&#x27;s certificate authority was used to issue fraudulent certificates, the damage to their business could be in the hundreds of millions. What if the silence is because Symantec is trying to figure out the best way to break the news to us?<p>Edit: After a bit more reading, Symantec has some history of monitoring .pw for malware and spam.[1][2][3] Perhaps someone just decided they wanted nothing more to do with PW issuer Directi, which apparently has a poor reputation.[4]<p>[0]<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DigiNotar" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DigiNotar</a><p>[1]<a href="http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;rise-pw-urls-spam-messages" rel="nofollow">http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;rise-pw-urls-spam-mess...</a><p>[2]<a href="http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;pw-hit-and-run-spam-royal-baby-trend" rel="nofollow">http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;pw-hit-and-run-spam-ro...</a><p>[3]<a href="http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;rig-exploit-kit-used-recent-website-compromise" rel="nofollow">http:&#x2F;&#x2F;www.symantec.com&#x2F;connect&#x2F;blogs&#x2F;rig-exploit-kit-used-r...</a><p>[4]<a href="http:&#x2F;&#x2F;www.jl.ly&#x2F;Email&#x2F;palau.html" rel="nofollow">http:&#x2F;&#x2F;www.jl.ly&#x2F;Email&#x2F;palau.html</a>

This is strange. An entire TLD? Symantec hasn&#x27;t issued an announcement. There&#x27;s nothing on the CA&#x2F;Browser Forum mailing list. Nothing on the Symantec Security Response Blog. Nothing on Symantec&#x27;s Twitter feeds.<p>Symantec stopped issuing certs in .PW six days ago, according to a blog post.[1] But there appears to have been no public announcement. Even if there was a major security breach justifying this, Symantec has botched the revocation and has lost much trust.<p>[1] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;sysadmin&#x2F;comments&#x2F;3j9iyk&#x2F;just_a_heads_up_symantec_is_cancelling_ssl&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;sysadmin&#x2F;comments&#x2F;3j9iyk&#x2F;just_a_hea...</a>

For everybody else who was wondering, .pw is Palau, a tiny island nation (pop. 17k) in Micronesia:<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;.pw" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;.pw</a><p>And apparently its sole decent hotel is smart enough to use a .com instead:<p><a href="http:&#x2F;&#x2F;www.palauppr.com&#x2F;default-en.html" rel="nofollow">http:&#x2F;&#x2F;www.palauppr.com&#x2F;default-en.html</a>

The current CA PKI system is pure madness. Everyone in the CA club can issue certificates for anything - and you are at their mercy for not revoking. And what&#x27;s worse, even if you pick a decent vendor, you can&#x27;t prevent shadier outfits from also issuing parallel certs. :(

Why on earth should any CA be getting involved in what a site hosts? They need to validate ownership and stop.

&quot;But here&#x27;s the thing: why did Geotrust just go ahead and revoke the certificates for all .PW domains without any warning?&quot;<p>Why indeed? My first notice of this was a client unable to use the app even though the cert was issued less than 6 months ago and was a 2 year cert. Like the author I also initially thought client configuration issue until I tried.<p>I contacted the reseller who didn&#x27;t have an answer right off the bat but had to contact Geotrust. After 15 minutes of fooling around I got an answer and a refund. So yes, they issued me a refund. Great. My clients had downtime. I had to drop what I was doing &quot;right then&quot; and install new certs. Finally I had to walk clients through clearing old certs from their browser as they were getting the scary &quot;Untrusted!&quot; popup. Fortunately this is a private app for a specific client so there weren&#x27;t a bunch of calls.<p>Geotrust&#x27;s handling of this was ridiculous. No email, no notification... I&#x27;ll certainly never get a cert from then again over this incident.

Let&#x27;s encrypt it&#x27;s starting to issue the first certificates[1].<p>Hopefully dealing with bad CAs will be a thing of the past.<p>[1] <a href="https:&#x2F;&#x2F;letsencrypt.org&#x2F;2015&#x2F;08&#x2F;07&#x2F;updated-lets-encrypt-launch-schedule.html" rel="nofollow">https:&#x2F;&#x2F;letsencrypt.org&#x2F;2015&#x2F;08&#x2F;07&#x2F;updated-lets-encrypt-laun...</a>

I think DNS signing authorities are a bunch of outlaws. They charge for trust, yet don&#x27;t establish it themselves.

Btw, can someone explain to me how revocation interacts with certificate pinning?

I&#x27;ve had issues with other registrars revoking certificates for questionable reasons (i.e., any reason other than obvious loss of control of the private key).<p>Is there a &quot;bulletproof&quot; registrar that doesn&#x27;t revoke? If my client loses thousands of dollars per day of downtime I&#x27;m sure they&#x27;d be willing to pay through the nose for it.<p>I understand the reasons for having a revocation system but it&#x27;s often not a benefit to me on balance-of-risks basis.

Is this for real? All we have is one unknown blogger, Colin Keigher, picked up by other sources. It&#x27;s Tuesday afternoon, so everyone is back at work. A takedown of an entire TLD should have hit news sources and major security blogs by now. I&#x27;m not seeing anything other than echos of the original blog post. It hasn&#x27;t even come up on the CA&#x2F;Browser forum mailing list or security blogs.

I just developed a browser to server based crytpo channel meant to replace the SLL certificate mess on a side project I&#x27;m working on. I know that there&#x27;s a bad rap for browser based crytpo and rolling your own but I&#x27;ve got some knowledge and thought I would give it a shot.<p>The code is not public (yet) but uses DH key exchange (using the JS BigInt library) to exchange a 2048 bit token key and then uses sjcl to perform encryption on each packet&#x2F;request using the resulting key.<p>It&#x27;s lacking host validation (am I talking to the correct server?), but I&#x27;m still working getting that piece together.

I don&#x27;t know who thought that having the possibility of revoking certificates was a good idea, especially when that possibility is controlled by CAs