Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chinese CA WoSign faces revocation after possibly issuing fake certificates

percya.com

Post reply on HN
Print view View original

41–50 of 116 posts

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#41

Post by noinsight »

MichaelGG wrote: post #3
mtgx wrote: post #2

> Possible fake cert for Github https://crt.sh/?id=29647048 https://crt.sh/?id=29805567 > Possible fake cert for Alibaba, the largest commercial site in China https://crt.sh/?id=29884704 > Possible fake cert for Microsoft https://crt.sh/?id=29805555 Yikes. If all of that is true, surely Google will permanently ban WoSign from Chrome? And I would hope Mozilla and Microsoft, too, but Google is usually the one to "play…

Or maybe limit them to certain .cn domains? (Excluding well known targets?)

Supposedly name constraints are not universally supported though.

See:

http://security.stackexchange.com/questions/31376/certificat...

http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#42

Post by snuxoll »

wyuenho wrote: post #31
pfg wrote: post #19

Earlier quoted context omitted.

They're cross-signed by StartCom, which is trusted by MacOS.

True, is there anything a SSL cert manager can do short of a blanket ban of StartCom certs?

You can add code to fail validation if this specific intermediate certificate is in the trust chain, but there's no way to ban intermediate certificates with the X.509 trust model without removing the root from the CA store.

Firefox/Chrome already do some extra validation to ban SHA1 certs issued past a specific date, they'd just need to blacklist the fingerprint of the intermediate CA.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#43

Post by guelo »

kobayashi wrote: post #35
guelo wrote: post #15

I just went to delete these roots from my Windows system but it's not listed. It was in Firefox's list but not in Window's. Anyone know why?

Anybody know how to delete certs from Firefox on OS X?

Settings -> Advanced -> Certificates -> View Certificates -> Authorities

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#44

Post by Kadin »

aianus wrote: post #37
wildmusings wrote: post #30

Is there an easy way for me to revoke trust from all Chinese CAs? Anyone in China is ultimately subject to being forced to do the dirty work of the Chinese Communist Party. Why are browser and OS vendors even trusting them in the first place?

I untrusted all Chinese-sounding CAs from "System Roots" under "Keychain Access" in OSX as soon as I got my laptop. That's what Chrome and Safari verify against.

That wouldn't have helped you in this case -- WoSign doesn't even show up in the OS X or Windows root keystores. Its certificates are (apparently) signed by StartCom.

I just blacklisted StartCom's root certs. IMO for signing off on WoSign they're just as guilty, if not worse, than WoSign itself. Since they're the ones with the root cert in the OS, the buck stops there.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#45

Post by geofft »

mrb wrote: post #29
the_mitsuhiko wrote: post #27

Earlier quoted context omitted.

So what is the solution to big banks and big CAs? We are just in the process of collectively creating the biggest CA the world ha sver seen.

With CT we could in theory revoke big CAs without impacting sites currently using them.

You need the CA to either have been cooperating with CT all along, or have kept a copy of all the certs it ever issued, neither of which an incompetent CA is likely to have done.

Symantec, whom one would expect to be one of the more competent CAs out there, cannot do this: https://security.googleblog.com/2015/10/sustaining-digital-c...

But Google did require them to use CT for all new certificates, which I think they are enforcing by assuming Symantec won't lie about the issuance date of new certs.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#46

Post by aianus »

Kadin wrote: post #44
aianus wrote: post #37

Earlier quoted context omitted.

I untrusted all Chinese-sounding CAs from "System Roots" under "Keychain Access" in OSX as soon as I got my laptop. That's what Chrome and Safari verify against.

That wouldn't have helped you in this case -- WoSign doesn't even show up in the OS X or Windows root keystores. Its certificates are (apparently) signed by StartCom. I just blacklisted StartCom's root certs. IMO for signing off on WoSign they're just as guilty, if not worse, than WoSign itself. Since they're the ones with the root cert in the OS, the buck stops there.

Yup, you're absolutely right. I've also blacklisted StartCom after reading through the comments on this thread.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#47

Post by [deleted] »

michaelt wrote: post #5

Traditionally it's difficult for browser vendors to revoke a root CA as they want to grandfather in old certificates, so existing sites don't have the rug pulled out from under their feet when their only crime is using a crap CA. Partial solutions include blocking the CA's certs based on the issuance date or insisting they hand over a list of the certs they've issued - but if the CA is going down in flames anyway, th…

[deleted]

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#48

Post by jaas »

This is a pretty misleading title for a couple of reasons:

1) WoSign may face revocation (I doubt it but I don't know), but there is no evidence of that in this article. This is just one person not affiliated with a root program "calling for" it. People on the internet call for revocation of major CA roots all the time.

2) I don't really know what a "fake" cert is, it's a very strange choice of words. I would think a fake cert is not a real cert, and in that case issuing fake certs is fine because browsers won't trust them. It seems the problem here is that real certs were issued when they shouldn't have been. That's called "mis-issuance", not "fake certs."

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#49

Post by LoSboccacc »

privong wrote: post #28
LoSboccacc wrote: post #20

Earlier quoted context omitted.

> their only crime is using a crap CA thing is the whole castle is built upon trust. if you don't punish crap CA and ppl who don't do research first, things will deteriorate rapidly.

> if you don't punish ... ppl who don't do research first, things will deteriorate rapidly. Is there a way customers would have or could have known beforehand that this CA was fishy? I agree that the CA should be punished/ostracized, but it isn't obvious to me that most of its customers would have known they were a fishy CA.

on first google search:

https://news.ycombinator.com/item?id=8982013

" It's 2015. They're using SHA-1 for everything (NOOOO!). They're based in China, which has just said it wants to ban encryption. It looks like they've messed up OSCP, so even their own cert doesn't pass. Oh, and RC4, TLS 1.0 "

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#50

Post by 0x0 »

So what's the relation to StartCom/StartSSL? I remember reading some comments about half a year ago mentioning that the startssl website suddenly was hosted on Chinese IP addresses, just around the time they redesigned the web page. This seemed fishy enough back then that I finally switched from startssl to letsencrypt for non-wildcard certs and actually started paying a different CA for wildcart certs...

Did the StartSSL root CA change hands / was it sold to a Chinese company (Wosign?)

I seem to remember the CEO used to be vocal in various ssl and ca forums and on bugzilla earlier.... But no comments lately?

Post reply on HN