Chinese certificate authority StartCom, which was blacklisted in Firefox, Chrome, Safari, and Edge for bad practices, to shut down and revoke all certs by 2020
Chris Duckett / ZDNet :
Context & Ripple Effects
StartCom's shutdown is the endgame of a two-year trust collapse. Google Chrome moved against the Chinese certificate authority as early as 2015 over a breach of trust, then in July 2017 announced complete distrust of WoSign and StartCom certificates with Chrome 61, after several wrongly issued certs. By August, Microsoft had disabled the CAs' certificates too, joining Apple, Google, and Mozilla — leaving StartCom untrusted in all four major browser engines.
The parallel is Symantec: months earlier, Chrome began stripping extended-validation status from Symantec-issued certificates and phasing out its valid certs. Together the two cases show browsers acting as a coordinated de facto regulator of the web's trust hierarchy — and StartCom is the first of the two to fold entirely.
First-order effects
- Every site still running a StartCom or WoSign certificate must migrate to another CA before the 2020 revocation deadline or face browser warnings across Firefox, Chrome, Safari, and Edge.
- StartCom exits the certificate business outright; its parent WoSign loses its subsidiary and any remaining path back into browser trust stores.
Second-order effects
- Competing certificate authorities absorb the displaced customer base, and the four browser vendors' willingness to act in concert raises the compliance bar — and the existential risk — for every other CA with issuance lapses.
- Enterprises and hosting providers re-evaluate CA concentration risk, since a single vendor's blacklist decision can strand an entire customer base overnight.
Third-order effects
- If the pattern holds, browser vendors function as the web PKI's real governing body, with the power to end certificate authorities through coordinated distrust rather than formal regulation — pushing the industry toward fewer, more heavily audited CAs.
The trend: Browser makers are consolidating into the de facto regulators of web trust, using coordinated certificate distrust to force weak certificate authorities out of the market.