Certificate authority StartCom stops due to loss of browser trust

The Chinese certificate authority StartCom has announced that it will stop its activities, as a result of which the company will no longer issue certificates from 2018. The decision follows the withdrawal of trust in the authority by Google and Mozilla, among others.

StartCom, through board chairman Xiaosheng Tan, said in a message to a Mozilla mailing list that it made the decision after “careful consideration”. After the company stopped issuing certificates on January 1, 2018, it will destroy its three root certificates two years later. Xiaosheng Tan, who is also chief security officer at StartCom parent company Qihoo 360, writes that the certificate authority has “gone a difficult reintegration process.”

The problems surrounding StartCom and sister company WoSign came to light in 2016 after Mozilla conducted an investigation. For example, the certificate authorities issued certificates for domains without the permission of the respective owners and subsequently changed the date of issue of certificates. Mozilla therefore decided in October 2016 to withdraw its trust in the organizations.

This decision was followed by Google, Apple and Microsoft, among others. Last year, the parent company announced another reorganization of the companies. In doing so, WoSign and StartCom were separated, after WoSign had previously taken over the authority without notification. Qihoo 360 does not disclose what the current decision means for WoSign.