Microsoft disables security certificates from Chinese CA WoSign and its StartCom subsidiary because of bad practices, joining Apple, Google, and Mozilla
Microsoft has joined Apple, Google, and Mozilla in disabling security certificates from Chinese company WoSign and its StartCom subsidiary.
Context & Ripple Effects
Microsoft's move closes a year-long loop that began when Mozilla accused WoSign of back-dating SHA-1 certificates and proposed dropping trust in them, followed by Google's plan to fully distrust WoSign and StartCom in Chrome 61. With Apple and Mozilla already out, Microsoft was the last major browser engine still trusting the Chinese CA.
The significance is unanimity: all four browser vendors now independently reached the same verdict on WoSign and StartCom, leaving no mainstream browser that honors their certificates. For a CA, losing trust across every major platform is effectively a death sentence.
First-order effects
- Sites still running WoSign or StartCom certificates break or throw warnings in Edge and Internet Explorer, forcing operators to reissue certs from a surviving CA immediately.
- WoSign and StartCom lose the last large distribution channel for new certificates, since Windows-based browsers can no longer validate what they issue.
Second-order effects
- With Firefox, Chrome, Safari, and Edge all distrusting it, StartCom has no viable market left — the path that ends in its shutdown and full certificate revocation by 2020.
- Other CAs, particularly those with loose issuance controls, now face a demonstrated playbook: any one vendor's audit finding can cascade into a four-way consensus distrust within months.
Third-order effects
- Browser vendors are functioning as de facto regulators of the web's trust infrastructure, replacing slow national oversight with coordinated commercial decisions — a pattern that recurs when Google, Mozilla, and Apple jointly blocked Kazakhstan's government root certificate two years later.
- Certificate authorities worldwide are pushed toward stricter issuance discipline and transparency, because the cost of a single violation is no longer one browser's penalty but exclusion from the entire ecosystem.
The trend: Browser vendors are consolidating into the effective governing body of the web's public key infrastructure, acting in concert to decide which certificate authorities survive.