How WoSign, a Chinese CA, issued a valid SSL cert for GitHub's primary domain to a subdomain user, and didn't revoke it even after vulnerability was reported
Stephen Schrauger / Schrauger.com : Tweets: @filosottile , @returnstring , @kennwhite and @juliocesarfort Tweets: Filippo Valsorda / @filosottile : I untrusted the WoSign root, well prepared to some Internet breakage. So far, only one link failed: [warning: irony] https://www.schrauger.com/... Ruan Pearce-Authers / @returnstring : Security craziness of the week so far: domain ownership validation fails at WoSign, a CA issuing free certs. https://www.schrauger.com/... Kenn White / @kennwhite : Between incompetence in issuing bogus SSL certs and the failure to revoke, Wosign should get the CA nuclear option. https://www.schrauger.com/... Julio / @juliocesarfort : your weekly reminder that the current CA model is broken beyond repair: https://www.schrauger.com/...
Context & Ripple Effects
This writeup documents the incident that set off WoSign's collapse: the CA validated control of github.com through a subdomain and issued a valid certificate for GitHub's primary domain to an unrelated user, then left it live even after researchers reported it. The disclosure spread fast — Filippo Valsorda publicly removed the WoSign root from his own trust store, with Kenn White and Ruan Pearce-Authers amplifying the validation failure.
The episode fed directly into what came next in the coverage: within weeks Mozilla accused WoSign of back-dating SHA-1 certificates and proposed dropping trust in its certificates entirely (Mozilla's distrust proposal), and by mid-2017 Google moved to fully distrust WoSign and its StartCom subsidiary in Chrome 61 (Chrome 61 distrust plan).
First-order effects
- GitHub's primary domain was effectively spoofable to any visitor whose browser trusted the WoSign root, since the certificate was technically valid despite the broken domain-validation process.
- Researchers like Valsorda began unilaterally untrusting the WoSign root ahead of any formal action, accepting breakage on WoSign-signed sites rather than wait for browser vendors.
Second-order effects
- Mozilla's response escalated from this single mis-issuance into an audit finding back-dated SHA-1 certificates, putting WoSign's entire customer base at risk of mass certificate replacement.
- Google, Microsoft, Apple, and Mozilla each moved to strip WoSign and StartCom from their trust stores, forcing every site still using those free certificates onto another CA.
Third-order effects
- The pattern — a free-certificate CA failing validation, then facing coordinated distrust by all major browser vendors — established that browser makers act as the de facto regulators of the WebPKI, a role later extended to non-technical concerns in the TrustCor Systems investigation.
- Validation failures at high-volume CAs push the industry toward stricter identity proofing, though the related coverage also shows the opposite pressure: certificates being sold against stolen corporate identities (stolen-identity certificate sales) suggests issuance controls remain uneven across the ecosystem.
The trend: Browser vendors are consolidating into the WebPKI's enforcement layer, increasingly willing to distrust entire certificate authorities over individual validation failures.