Chinese CA WoSign faces revocation after possibly issuing fake certificates • Hacker News Board

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#91

Post by pgaddict » Tue, Aug 30, 2016, 8:57 PM UTC

tajen wrote: post #72

joosters wrote: post #53

Earlier quoted context omitted.

Site operators need to be more aware of which CAs they're using How? I've got no way to judge the security / responsibility of any CA. The amount of money that they charge may have no relation to their behaviour. I don't think anyone has claimed that the CAs who issued wrong certs were charging less than their competitors. You can't blame the CA customers for this.

One sign is that if Symantec has issued rogue certificates, and Google publishes the problem, then it's time to leave. Of course, the CA would then be incentivized to publish their procedures and show how they intend to fix the breach, which shouldn't have happened in the first place, to regain customer's trust. Or go bankrupt. Let me tell you they wouldn't let their employees do mistakes. Customers who stay, in the…

Absolutely agree. Pulling the rug is a powerful incentive both for the customers and the CAs. Customers will have to consider the likelihood the CA will be revoked due to poor security practices, CAs will have to show that they're not rubbish.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#92

Post by pfg » Tue, Aug 30, 2016, 9:04 PM UTC

0x0 wrote: post #50

So what's the relation to StartCom/StartSSL? I remember reading some comments about half a year ago mentioning that the startssl website suddenly was hosted on Chinese IP addresses, just around the time they redesigned the web page. This seemed fishy enough back then that I finally switched from startssl to letsencrypt for non-wildcard certs and actually started paying a different CA for wildcart certs... Did the Sta…

This came up on the Mozilla mailing list and the most likely explanation is that they're sharing some infrastructure, i.e. one CA is hosting the other[1]. This is apparently quite common in the industry.

I don't think the Baseline Requirements (or any of the root program policies) currently require that CAs disclose these arrangements. I don't think CA hosting is inherently bad (in many cases I'd actually be happy to know that a CA is not running their own infrastructure), but it would probably be a good idea to force CAs to be transparent about it. If it's publicly known that WoSign and StartCom use the same domain validation infrastructure (just as an example, this might not be the case), that fact would be highly relevant for this discussion.

[1]: https://groups.google.com/d/msg/mozilla.dev.security.policy/...

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#93

Post by jlgaddis » Tue, Aug 30, 2016, 9:13 PM UTC

0x0 wrote: post #50

So what's the relation to StartCom/StartSSL? I remember reading some comments about half a year ago mentioning that the startssl website suddenly was hosted on Chinese IP addresses, just around the time they redesigned the web page. This seemed fishy enough back then that I finally switched from startssl to letsencrypt for non-wildcard certs and actually started paying a different CA for wildcart certs... Did the Sta…

StartCom or StartSSL? I believe those are not the same.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#94

Post by smsm42 » Tue, Aug 30, 2016, 9:14 PM UTC

icebraining wrote: post #88

smsm42 wrote: post #87

Earlier quoted context omitted.

> when their only crime is using a crap CA. Their punishment would be having to pay for another certificate and install it and using a more reputable one and not necessarily the cheapest one around next time. I think in this case the punishment fits the crime perfectly.

more reputable one and not necessarily the cheapest one The two don't seem to be linked at all; Symantec's cheapest cert (non-EV, no-wildcard) costs $399 - almost 80x the cheapest ones - and yet they were caught issuing unauthorized certs.

Oh, of course, expensive doesn't mean good. Maybe the cheapest one is the best one. I'm just saying the reputation should be a primary consideration, or at least one of. There should be consequences for bad behavior for CA vendors.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#95

Post by jwilk » Tue, Aug 30, 2016, 9:18 PM UTC

https://www.schrauger.com/the-story-of-how-wosign-gave-me-an...

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#96

Post by estebank » Tue, Aug 30, 2016, 9:25 PM UTC

mtgx wrote: post #2

> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…

> Possible fake cert for Github https://crt.sh/?id=29647048

https://www.schrauger.com/the-story-of-how-wosign-gave-me-an...

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#97

Post by 0x0 » Tue, Aug 30, 2016, 9:41 PM UTC

jlgaddis wrote: post #93

0x0 wrote: post #50

So what's the relation to StartCom/StartSSL? I remember reading some comments about half a year ago mentioning that the startssl website suddenly was hosted on Chinese IP addresses, just around the time they redesigned the web page. This seemed fishy enough back then that I finally switched from startssl to letsencrypt for non-wildcard certs and actually started paying a different CA for wildcart certs... Did the Sta…

StartCom or StartSSL? I believe those are not the same.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#98

Post by SimeVidas » Tue, Aug 30, 2016, 9:46 PM UTC

joosters wrote: post #51

jaas wrote: post #48

This is a pretty misleading title for a couple of reasons: 1) WoSign may face revocation (I doubt it but I don't know), but there is no evidence of that in this article. This is just one person not affiliated with a root program "calling for" it. People on the internet call for revocation of major CA roots all the time. 2) I don't really know what a "fake" cert is, it's a very strange choice of words. I would think a…

I don't really know what a "fake" cert is You are just being pedantic. The meaning is perfectly clear, they are creating certificates for a domain and giving them to people who do not control/own that domain. Pick whatever word you like to describe this. The story is very clear.

Speak for yourself. People get confused by the smallest ambiguities.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#99

Post by ak217 » Tue, Aug 30, 2016, 10:14 PM UTC

newjersey wrote: post #62

ak217 wrote: post #55

Earlier quoted context omitted.

I see two solutions to big CAs. One is to reengineer the CA trust system to delegate limited authority to CAs (e.g. there is no good reason for a CA in the US to be able to sign certificates with Chinese TLD CNs, and vice versa). The second is to build out the Certificate Transparency project to the point where the revocation of trust due to a mis-issued certificate is immediate, widespread, and automatic.

> The second is to build out the Certificate Transparency project to the point where the revocation of trust due to a mis-issued certificate is immediate, widespread, and automatic. I'd love to hear more about this. How would it work? Lets Encrypt gets a lot of flack because their certs need to renew every three months. I can't imagine why bad actors wouldn't immediately try to swamp any system of revocation with req…

Imagine a new flag for certificates issued by CAs that support CT, indicating that the domain owner (e.g. github.com) intends to continue to only use CT-capable authorities.

Any certificate issued for e.g. github.com by any other CA immediately become evidence of malicious conduct attributable directly to that CA, and grounds for automated revocation of trust.

I'm not sure what the lifetime of Let's Encrypt certs has to do with this. I'm also not certain how the bad actors would exploit this process, can you explain?

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#100

Post by pfg » Tue, Aug 30, 2016, 10:28 PM UTC

ak217 wrote: post #99

newjersey wrote: post #62

Earlier quoted context omitted.

> The second is to build out the Certificate Transparency project to the point where the revocation of trust due to a mis-issued certificate is immediate, widespread, and automatic. I'd love to hear more about this. How would it work? Lets Encrypt gets a lot of flack because their certs need to renew every three months. I can't imagine why bad actors wouldn't immediately try to swamp any system of revocation with req…

Imagine a new flag for certificates issued by CAs that support CT, indicating that the domain owner (e.g. github.com) intends to continue to only use CT-capable authorities. Any certificate issued for e.g. github.com by any other CA immediately become evidence of malicious conduct attributable directly to that CA, and grounds for automated revocation of trust. I'm not sure what the lifetime of Let's Encrypt certs has…

Chrome is experimenting with something called Expect-CT[1], which allows site operators to indicate that only certificates with valid SCTs should be trusted. The implementation is quite similar to HSTS. It's report-only for now, but will probably evolve to something like Require-CT (i.e. CT enforcement) in the future.

[1]: https://docs.google.com/document/d/1VDtHiKa5c96ohP_p-V1k6u83...