#qwac — Public Fediverse posts

#LetsEncrypt has suspended issuing certificates after it identified security issues in one of its roots (!)[^1]

We temporarily disabled certificate issuance, deployed a configuration change to prevent future issuance from the cross-signed Gen Y hierarchy, and then re-enabled issuance. Certificate revocation and CRL generation remains functional for Gen Y certificates.

A few days ago #DigiCert was hacked with a Windows (!) screensaver (!)[^2]

I cannot but remind that both organisations are part of the #WebTrust cartel who had last year unrolled a massive “grassroots” smear campaign against EU #QWAC certificates, presenting them as “security and privacy threat”, whereas from both legal and technical point of view QWAC is much more secure:

https://krvtz.net/en/posts/the-real-story-behind-eu-qwac.html

[^1]: https://community.letsencrypt.org/t/2026-05-08-gen-y-cross-certified-subordinate-cas-missing-serverauth-eku/247105

[^2]: https://cybersecuritynews.com/digicert-hacked-screensaver/

#LetsEncrypt has suspended issuing certificates after it identified security issues in one of its roots (!)[^1]

We temporarily disabled certificate issuance, deployed a configuration change to prevent future issuance from the cross-signed Gen Y hierarchy, and then re-enabled issuance. Certificate revocation and CRL generation remains functional for Gen Y certificates.

A few days ago #DigiCert was hacked with a Windows (!) screensaver (!)[^2]

I cannot but remind that both organisations are part of the #WebTrust cartel who had last year unrolled a massive “grassroots” smear campaign against EU #QWAC certificates, presenting them as “security and privacy threat”, whereas from both legal and technical point of view QWAC is much more secure:

https://krvtz.net/en/posts/the-real-story-behind-eu-qwac.html

[^1]: https://community.letsencrypt.org/t/2026-05-08-gen-y-cross-certified-subordinate-cas-missing-serverauth-eku/247105

[^2]: https://cybersecuritynews.com/digicert-hacked-screensaver/

#LetsEncrypt has suspended issuing certificates after it identified security issues in one of its roots (!)[^1]

We temporarily disabled certificate issuance, deployed a configuration change to prevent future issuance from the cross-signed Gen Y hierarchy, and then re-enabled issuance. Certificate revocation and CRL generation remains functional for Gen Y certificates.

A few days ago #DigiCert was hacked with a Windows (!) screensaver (!)[^2]

I cannot but remind that both organisations are part of the #WebTrust cartel who had last year unrolled a massive “grassroots” smear campaign against EU #QWAC certificates, presenting them as “security and privacy threat”, whereas from both legal and technical point of view QWAC is much more secure:

https://krvtz.net/en/posts/the-real-story-behind-eu-qwac.html

[^1]: https://community.letsencrypt.org/t/2026-05-08-gen-y-cross-certified-subordinate-cas-missing-serverauth-eku/247105

[^2]: https://cybersecuritynews.com/digicert-hacked-screensaver/

#LetsEncrypt has suspended issuing certificates after it identified security issues in one of its roots (!)[^1]

We temporarily disabled certificate issuance, deployed a configuration change to prevent future issuance from the cross-signed Gen Y hierarchy, and then re-enabled issuance. Certificate revocation and CRL generation remains functional for Gen Y certificates.

A few days ago #DigiCert was hacked with a Windows (!) screensaver (!)[^2]

I cannot but remind that both organisations are part of the #WebTrust cartel who had last year unrolled a massive “grassroots” smear campaign against EU #QWAC certificates, presenting them as “security and privacy threat”, whereas from both legal and technical point of view QWAC is much more secure:

https://krvtz.net/en/posts/the-real-story-behind-eu-qwac.html

[^1]: https://community.letsencrypt.org/t/2026-05-08-gen-y-cross-certified-subordinate-cas-missing-serverauth-eku/247105

[^2]: https://cybersecuritynews.com/digicert-hacked-screensaver/

#LetsEncrypt has suspended issuing certificates after it identified security issues in one of its roots (!)[^1]

We temporarily disabled certificate issuance, deployed a configuration change to prevent future issuance from the cross-signed Gen Y hierarchy, and then re-enabled issuance. Certificate revocation and CRL generation remains functional for Gen Y certificates.

A few days ago #DigiCert was hacked with a Windows (!) screensaver (!)[^2]

I cannot but remind that both organisations are part of the #WebTrust cartel who had last year unrolled a massive “grassroots” smear campaign against EU #QWAC certificates, presenting them as “security and privacy threat”, whereas from both legal and technical point of view QWAC is much more secure:

https://krvtz.net/en/posts/the-real-story-behind-eu-qwac.html

[^1]: https://community.letsencrypt.org/t/2026-05-08-gen-y-cross-certified-subordinate-cas-missing-serverauth-eku/247105

[^2]: https://cybersecuritynews.com/digicert-hacked-screensaver/

Last year a QWAC CA was discovered to have issued a test certificate for 1.1.1.1 and everyone lost their minds and some even suggested that it has something to do with QWAC.

Well, here's Cloudflare failing to properly handle ACME, and I'm waiting for people to call for dismantling Cloudflare altogether.

https://noc.social/@cloudflare/115927118835338970

Let's be honest, there is no accountability in the Web PKI. You want to be safe? Use DANE.

#ca #qwac #cloudflare #dane #pki

#QWAC might be awful but that doesn't make existing trust stores in the #WebPKI better: the decisions are basically made by going though a checklist and having some random people approve your application.