Under New Ownership, DigiCert Expands into Verified Mark Certificates

guest · Oct 17, 2019

Under New Ownership, DigiCert Expands into Verified Mark Certificates
October 17, 2019
https://www.securityweek.com/under-new-ownership-digicert-expands-verified-mark-certificates

Three years after Thoma Bravo acquired a majority holding in DigiCert, the Utah-based digital certificate firm has announced its acquisition by Clearlake Capital Group and TA Associates.

When the plan was first announced in July 2019, Thoma Bravo said, "As a part of the transaction, Clearlake and TA will become equal partners in DigiCert. The company will continue to be led by CEO John Merrill and the current management team, who are investing alongside Clearlake and TA in the transaction."

The email opportunity comes with the development of its own Verified Mark Certificate (VMC) for domains that send email at scale, and its upcoming pilots of the BIMI (Brand Indicators for Message Identification) standard that require validated logos.
BIMI is intended to work alongside DMARC.
Click to expand...

The issuing certificate authority for a VMC verifies an organization's registered trademarks and confirms their registration and ownership. The VMC is signed cryptographically with a trusted root, so that mail applications can rely on the information inside the certificate. Once this process is complete, the CA sends the VMC to the organization for its use.

Combining VMC and DMARC will allow organizations to add the marketing effect of their branded logo to phishing-proofed emails.
Click to expand...

DigiCert: DigiCert Acquisition by Clearlake Capital Group and TA Associates Closes

guest · Jul 9, 2020

Digicert will shovel some 50,000 EV HTTPS certificates into the furnace this Saturday after audit bungle
You've got less than 42 hours to regenerate your certs
July 10, 2020
https://www.theregister.com/2020/07/10/digicert_pulls_certs/

DigiCert says, come Saturday, July 11, it will revoke tens of thousands of encryption certificates issued by intermediaries that were not properly audited.

A notice emitted by the certificate biz explained that a number of its intermediate certificate authorities (ICAs) had issued EV certs to customers despite not being included in DigiCert's WebTrust audits – which goes against the rules for EV certs. To remedy this, DigiCert said it will revoke every single EV cert issued by the ICAs in question – think CertCentral, Symantec, Thawte, and GeoTrust.

"To resolve the issue, we must migrate issuance to new ICAs and revoke all certificates issued under the impacted ICAs," Digicert told its customers in an email.
Click to expand...

DigiCert only learned of the problem on July 2, and decided on Monday to throw the EV certs on the bonfire with the industry-mandated five days of notice. A plan to run a new audit is underway, and will likely take place next month.

As others point out, however, it isn't Digicert's call to only wait five days for the revocation. Rather, that is what is required by Mozilla and CAB Forum rules.
Click to expand...

Log in or Sign up

Under New Ownership, DigiCert Expands into Verified Mark Certificates

guest Guest

guest Guest

Log in or Sign up

Under New Ownership, DigiCert Expands into Verified Mark Certificates

guest Guest

guest Guest

Useful Searches