Chinese CA WoSign faces revocation after possibly issuing fake certificates
1–10 of 116 posts
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#2> Possible fake cert for Github
https://crt.sh/?id=29647048
https://crt.sh/?id=29805567
> Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704
> Possible fake cert for Microsoft https://crt.sh/?id=29805555
Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play tough" with rogue CAs (and I hope they will strive to develop and maintain that reputation).
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#3> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
Or maybe limit them to certain .cn domains? (Excluding well known targets?)
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#4> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
[deleted]
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#5Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA.
Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, they have no incentive to cooperate; they can backdate certs and destroy their own customer list.
My theory is [1] this is one of the side benefits of Certificate Transparency - CT will give browser vendors a list of certs to grandfather in if they decide to shut down a CA against its will.
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#6> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
[deleted]
You can only accept certs issued before a given date, though.
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#7> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…
[deleted]
I believe this is done by not accepting any certificate issued past date X. This way the old certificates keep working, while the new ones don't.
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#8Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…
+1 revoking a CA using the issuance date seems like the right solution
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#9Earlier quoted context omitted.
[deleted]
I believe this is done by not accepting any certificate issued past date X. This way the old certificates keep working, while the new ones don't.
WoSign was also caught red-handed backdating certificates to avoid the SHA1 deprecation.
So you can't trust that information either. As mentioned in a different thread, whitelisting certificates extracted from CT logs is the only really viable choice here.
Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates
#10Earlier quoted context omitted.
[deleted]
I believe this is done by not accepting any certificate issued past date X. This way the old certificates keep working, while the new ones don't.
The problem with this approach is that a CA that's been given the death penalty has little to lose, so they might just start backdating certificates. In fact, backdating SHA-1 certificates is one of the incidents they've now reported.
The only way to do this without the risk of backdated certificates being accepted would be to explicitly whitelist all known certificates that were issued prior to the cut-off date. I'm not sure how practical it is to ship such a large list, though (they've issued > 100k certificates in 2015 IIRC).