Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

Dear Sirs,

I've heard the fact was as follows:

-------------------------------------------------------------------------
Paul Tourret and Steve Waite were independent agents assigned the
responsibility of sales and marketing for the RapidSSL brand, acting under
a company called Certification Services Ltd (CSL). Verisign served
termination notice to CSL immediately after the announcement of the
GeoTrust acquisition. CSL then later changed its name to GlobalSign
Limited following successful acquisition of GlobalSign NV. RapidSSL.com
was, and always had been, an SSL brand owned in full by GeoTrust Inc.
GeoTrust elected to represent the brand as a business unit and as
mentioned above, Paul Tourret and Steve Waite were assigned as "agents" to
promote the brand.  All root Certificates and infrastructure was
maintained and operated alongside the GeoTrust branded roots and in
infrastructure operated by GeoTrust Inc.  In 2006 VeriSign acquired
GeoTrust and all its assets, including the RapidSSL brand and root
Certificates.  Paul and Steve ceased their relationship with GeoTrust (now
owned by VeriSign) in late 2006.  At the time of the rogue issuance of
RapidSSL root Certificates, ownership and infrastructure of maintenance
had been under VeriSign's control for over 2 years.  To be clear, VeriSign
did not switch away from MD5 on behalf of RapidSSL, RapidSSL is just a
product brand (not a company) owned in full by VeriSign.
------------------------------------------------------------------------------------------

Regards,
Koichi Sugimoto.

2011/6/5 Yoav Nir <ynir@checkpoint.com>:
>
> On Jun 3, 2011, at 5:55 AM, Peter Gutmann wrote:
>
>> Yoav Nir <ynir@checkpoint.com> writes:
>>
>>> In late 2008, when some researchers got RapidSSL to sign a certificate
>>> request that collided with their rogue sub-CA certificate, several things
>>> came to light:
>>> - They were a ridiculously small company, with the only full-time employee.
>>> An accountant
>>
>> I wasn't aware of this one, do you have any pointers to info on this?  I guess
>> a Webtrust audit doesn't check whether you have more than a single employee :-).
>>
>> Peter.
>
> I'm not sure where I've read it. Probably some blog entry about the incident. Not Bruce Schneier's because his entries are still online.
>
> Anyway, checking the data for now, Business Week has this:
> http://investing.businessweek.com/research/stocks/private/people.asp?privcapId=20888814
>
> It lists two "key executives", VP Marketing and VP Sales and no CEO/President. Click their links, and both have other jobs at Globalsign and other companies.
>
> The key issue is the total lack of in-house expertise. Late in 2008, it wasn't RapidSSL that switched to MD5. Verisign did it for them:
> http://www.thetechherald.com/article.php/200852/2708/VeriSign-replaces-RapidSSL-certificates
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>