Chinese root CA issues rogue/fake certificates

Eric Kuhnke eric.kuhnke at
Wed Sep 7 23:15:47 UTC 2016

Further update on all known suspicious activity from Wosign:

Seriously, what level of malice and/or incompetence does one have to rise
to in order to be removed from the Mozilla (and hopefully Microsoft and
Chrome) trusted root CA store?  Is this not sufficient?

On Thu, Sep 1, 2016 at 3:19 AM, Stephane Bortzmeyer <bortzmeyer at>

> On Thu, Sep 01, 2016 at 11:36:57AM +1000,
>  Matt Palmer <mpalmer at> wrote
>  a message of 45 lines which said:
> > I'd be surprised if most business continuity people could even name
> > their cert provider,
> And they're right because it would be a useless information: without
> DANE, *any* CA can issue a certificate for *your* domain, whether you
> are a client or not.

More information about the NANOG mailing list