CA:WoSign Issues

So, can I ask an awkward question? Realistically speaking, is there <i>any</i> chance that a large CA would ever actually be removed from Mozilla&#x27;s store, no matter how severe their malfeasance?<p>I started wondering this after they declined to remove StartSSL after the Heartbleed fiasco, and while I sort of understood the reasoning there in isolation, between that incident and this long list of WoSign violations, I&#x27;m really getting the sense that CA&#x27;s are &quot;too big to fail&quot; and that the downsides of suddenly breaking huge parts of the internet on unsuspecting users mean that the threat of removing badly-behaving CA&#x27;s is an empty one. What would a CA have to do to <i>actually</i> be removed, especially if they were to sign really huge sites?

Does anyone know if it&#x27;s possible to write a Firefox add-on that could warn you that the site you&#x27;re connecting to uses one of these less trustworthy or esoteric CAs? I&#x27;ve looked through the APIs, but I don&#x27;t see any hooks for that kind of info.<p>EDIT: Now that I think about it, it must be possible, Certificate Patrol is looking at the cert info, I&#x27;ll see how they do it.

I&#x27;m starting to think that a service such as SSL Labs should also grade CAs (perhaps by looking through Certificate Transparency logs as well, once all CAs have to use them).<p>Then if you use like a &quot;C-rated&quot; CA, your HTTPS score is also limited to B. A B-rate CA would limit your HTTPS score to A, and only an A-rated CA would allow you to get A+ on SSLabs. Something along those lines.<p>I imagine rating the CAs would be quite a complex task, but they could start with the big ones first that own 80-90% of the market.

&gt; For example, a cert where the owner validated &quot;netwi.ru&quot; was able to add &quot;mx.idisk.su&quot;, an entirely different domain, without validating it.<p>Now that&#x27;s odd, because I know those two domains. I&#x27;ve even requested some certificates for them myself before (never had anything odd - I think I would&#x27;ve noticed if there was a way to add a domain without validation), but I left the company in January 2015.<p>It was my coworker requesting that certificate, and I&#x27;ve just found - still have the access to the servers as I help them with small issues on rare occasions - that at the same date it was issued (Feb 26, 2015) he had most certainly got a validation file (idisk.su.html) and put it into idisk.su&#x27;s static root.<p>Webserver logs are, of course, long gone so can&#x27;t really tell if it was actually accessed or not, but I think when I had requested certificates myself it was a wizard-style process where one got a file to download and the only next action was to validate it, no other way to proceed.<p>I mean, at least he got the file and put it there, in a proper place. And it&#x27;s also weird that the certificate in question (<a href="https:&#x2F;&#x2F;crt.sh&#x2F;?id=29805560" rel="nofollow">https:&#x2F;&#x2F;crt.sh&#x2F;?id=29805560</a>) had included another idisk.su subdomain (mail.idisk.su) that wasn&#x27;t marked as not validated in the report (<a href="https:&#x2F;&#x2F;www.wosign.com&#x2F;report&#x2F;wosign_incidents_report_09042016.pdf;" rel="nofollow">https:&#x2F;&#x2F;www.wosign.com&#x2F;report&#x2F;wosign_incidents_report_090420...</a> page 13).<p>I don&#x27;t doubt there was a severe bug. But this leaves me wondering whenever the analysis followed was really accurate (not saying it wasn&#x27;t, but still sort of curious that it could be).

Where WoSign have demonstrated glaring incompetence and utter ignorance of security practices as an CA, I doubt these issues aren&#x27;t violated at quite a few dozens of other CAs. These are good lessons for other CAs.<p>To me, the ultimate question is this: if we are trusting CAs as the 3rd party entity in order to make PKI schemes work, then who&#x27;s going to be auditing the &quot;supposedly trustworthy&quot; party?

While I&#x27;ve seen some scripts to &quot;blackhole&quot; so-called bad&#x2F;suspicious CAs, I have yet to find something that cleans things across the board for different browsers.<p>Apple&#x27;s implementation of &quot;Rootless&quot; while useful for other things hasn&#x27;t helped by denying the ability to remove certs unless one reboots into recovery and does &quot;csrutil disable&quot;.

Hopefully one day we will replace CAs with something decentralized(i.e based on DNSSEC). CAs make sense only if you need an EV certificate.