Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Yoav Nir <[e-mail]>]

On Jun 7, 2011, at 4:31 AM, koichi sugimoto wrote:

> Dear Sirs,
> 
> I've heard the fact was as follows:
> 
> -------------------------------------------------------------------------
> Paul Tourret and Steve Waite were independent agents assigned the
> responsibility of sales and marketing for the RapidSSL brand, acting under
> a company called Certification Services Ltd (CSL). Verisign served
> termination notice to CSL immediately after the announcement of the
> GeoTrust acquisition. CSL then later changed its name to GlobalSign
> Limited following successful acquisition of GlobalSign NV. RapidSSL.com
> was, and always had been, an SSL brand owned in full by GeoTrust Inc.
> GeoTrust elected to represent the brand as a business unit and as
> mentioned above, Paul Tourret and Steve Waite were assigned as "agents" to
> promote the brand.  All root Certificates and infrastructure was
> maintained and operated alongside the GeoTrust branded roots and in
> infrastructure operated by GeoTrust Inc.  In 2006 VeriSign acquired
> GeoTrust and all its assets, including the RapidSSL brand and root
> Certificates.  Paul and Steve ceased their relationship with GeoTrust (now
> owned by VeriSign) in late 2006.  At the time of the rogue issuance of
> RapidSSL root Certificates, ownership and infrastructure of maintenance
> had been under VeriSign's control for over 2 years.  To be clear, VeriSign
> did not switch away from MD5 on behalf of RapidSSL, RapidSSL is just a
> product brand (not a company) owned in full by VeriSign.
> ------------------------------------------------------------------------------------------

Thanks for this.

The point remains, that the customers see only the RapidSSL brand, no sign of Verisign on the homepage. And obviously they were running with a very different web application than other Verisign affiliates. Even as just a product brand, some people were assigned to handle the website and the CA, and despite being owned by Verisign, those people apparently weren't doing a very good job.

Yoav