200812: About the Certstar case

On December 22, 2008 Certstar was caught issuing a 1-factor certificate (domain-validated) to an entity not related to the domain: a classic MITM! Thanks to a failing vetting process, this Comodo's RA issued a certificate on sub-CA PositiveSSL CA. Those RA's certificates have been re-audited and some of them revoked.

This case details can be consulted here: https://bugzilla.mozilla.org/show_bug.cgi?id=470897

It highlights what we've been saying for several years now:

• domain-validated certificates are dangerous (Why are domain-validated certificates dangerous?)
• CRLs management is not correctly implemented in Mozilla's products (see here)
• There should be a simple way to ban a sub-CA from Mozilla's products and the list of CAs should be validated by each RSSI (see here)