Comodo withdraws certificates for no reason.

Could you imagine that a large company will engage in deceiving its customers, especially if this company is positioning itself as a security guarantor? So I could not until recently. This article is a warning that you think about it ten times before buying a certificate to sign a code from Comodo.

On duty of my work (system administration), I make various useful programs that I actively use in my own work, and at the same time I post for free for everyone. About three years ago, there was a need to sign programs, otherwise not all of my clients and users could easily download them only because they were not signed. For a long time, a signature is a normal practice and it doesn’t matter how safe the program is, but if it is not signed, it will definitely be heightened attention:

1. The browser collects statistics on how often the file is loaded, and when it is not signed, then at the initial stage it may even be blocked “just in case” and require an explicit confirmation from the user to save. Algorithms are different, sometimes the domain is considered trusted, but in general it is a valid signature that confirms the security.
2. After downloading the file looks antivirus and immediately before running the OS itself. For antiviruses, the signature is also important, it is easy to trace on virustotal, and as for the OS, starting with Win10, the file with the revoked certificate is immediately blocked and cannot be launched from the explorer. In addition, in some organizations it is generally forbidden to run unsigned code (configured by the system), and this is justified - all normal developers have long taken care of that their programs can be checked without additional efforts.

In general, the direction chosen is correct - as far as possible to make the Internet as safe as possible for inexperienced users. However, the implementation itself is far from ideal. A simple developer can not just get a certificate, you need to buy it from companies that have monopolized this market and dictate their conditions on it. But what if the programs are free? It doesn't bother anyone. Then the developer has a choice - to constantly prove the safety of their programs, sacrificing the convenience of users, or buying a certificate. Three years ago, StartCom, which now lives at the bottom of the ocean, was profitable, with them never had problems. At the moment, the minimum price is provided by Comodo, but as it turned out, there is a catch - for them, the developer is literally nobody and throwing it is a normal practice.
')
After nearly a year of using the certificate, which I bought in mid-2018, suddenly, without prior notice by mail or phone, Comodo withdrew it without giving reasons. Their technical support works poorly - they may not respond for a week, but they managed to find out the main reason - they felt that the certificate issued was signed with malware. And the story could have been completed if it were not for one thing - I never created malware, and my own protection methods allow us to state that it is impossible to steal the private key from me. Only Comodo has a copy of the key, because they give them out without CSR. And then - almost two weeks of unsuccessful attempts to find out the elementary evidence. The company, which allegedly guarantees security protection, flatly refused to provide evidence of violation of their rules.


Such a result is not unique, all the negotiations in the chat are at best the same thing, the tickets are either not answered at all, or the answers are just as useless.


The hope that the monkey will not answer me, finally disappears. An interesting scheme emerges:

1. We sell the certificate.
2. We are waiting for more than six months, so that through PayPal it was impossible to open a dispute.
3. Call back and wait for the next order. Profit!

Since I do not have other methods of influence on them, I can only make their fraud public. Buying a certificate from Comodo, they are also Sectigo, you can face the same situation.

Update # 1 of June 9:

Today I notified CodeSignCert (the company through which I bought the certificate) that since they stopped responding, I submitted the situation to a public discussion with reference to this article. After some time, they finally sent a screenshot of virustotal, where the hash of the EzvitUpd program was visible:
VirusTotal - d92299c3f7791f0ebb7a6975f4295792fbbf75440cb1f47ef9190f2a4731d425

My assessment of the situation:
I can say with confidence that this is a false positive. Signs:

1. Generic designation in most positives.
2. Lack of triggers by antivirus leaders.

It is difficult to say what exactly caused this antivirus reaction, but since the file is very outdated (it was created almost a year ago), I did not have the source version 1.6.1 to re-create the file in binary. However, I have the latest version 1.6.5, and taking into account the invariance of the main branch, minimal changes were made there, but there is no such false response for it:
VirusTotal - c247d8c30eff4449c49dfc244040fc48bce4bba3e0890799de9f83e7a59310eb

CodeSignCert notified of false positives, after the appearance of further results of the negotiations, the article will be updated until the situation is completely resolved.

Update # 2 of June 11:

CodeSignCert put an almost impossible condition - they want VirusTotal to be 100% clean of any positives. This is technically almost impossible, because not all antiviruses respond to feedback, some even mail does not work.

In the comments, gogetssl undertook to help and promised "Symantec Code Signing for a period of 3 years," and then refused to fulfill the promise in personal messages. Nobody involved channels and did not apologize.

At the time the link was provided, there were 17 false positives; at the time of the last check, 14 antiviruses corrected their mistake.