WoSign Announces Restructuring and Replaces CEO After Mozilla Investigation

The Chinese company Qihoo 360, the largest shareholder of the certificate authorities WoSign and StartCom, has indicated that it is carrying out a restructuring of the companies. This is the result of an investigation by Mozilla into the certificates issued by the authorities.

In a response in a mailing list, StartCom founder Eddy Nigg explains that several measures have been taken. For example, StartCom and WoSign have been separated, with StartCom coming directly under Qihoo 360 in the future. All the merged functions of the companies must be separated, including the development teams and management. WoSign CEO Richard Wang was also fired from his position, according to a more extensive report from WoSign.

The same document shows that WoSign has issued 64 certificates with the date adjusted to bypass the sha-1 certificate blocking. WoSign further states that it will publish all future and already issued certificates on CT servers. The changes in the companies should lead to ‘WoSign and StartCom having a board that understands how a certificate authority should be run and that adheres to the applicable standards’.

Mozilla launched an investigation into the certificate authorities because they made several mistakes. For example, it was possible to request certificates for another domain and WoSign issued certificates with the outdated sha-1 hash. Mozilla announced at the end of September that it would block the certificates from the authorities. Other parties followed suit. For example, Apple recently reported that it would block the certificates.