In August 2016 it was reported that StartCom was sold to WoSign, a Chinese CA.[14][27][28] The original disclosure was taken down for legal reasons.[29] However, repostings of the original articles are still available.[27] The relationship is unclear, but it seems as if the StartCom technical infrastructure was being used by WoSign when they were caught issuing about a hundred[30] improperly validated SSL certificates, including a certificate for github.com.[14][31]

An investigation by Google and Mozilla found that WoSign knowingly and intentionally mis-issued certificates in order to circumvent browser restrictions and CA requirements. As a result, Google joined Mozilla and Apple and will distrust WoSign and StartCom certificates beginning in 2017. [32] On July 17, 2017, an announcement was made about the restructuring of the company. It was announced that Startcom is now 100% managed by Qihoo360, no Startcom employees are working on Wosign premises, audits have been made by external pen testers, and a new CMS system was developed.