A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

Post by bitwize » Sun, Dec 01, 2024, 3:31 AM UTC

amluto wrote: post #59

tialaramex wrote: post #13

Earlier quoted context omitted.

These are generally government CAs, so, typically the situation is Microsoft sold the government Windows, and as part of that deal (at least tacitly) agreed to the CA being trusted, and so every system that's trusting these certificates is a Windows PC anyway, running Edge because the whole point was the government will only use Windows and pays Microsoft $$$. Why bake it into everybody else's Windows? If you make sa…

The solution seems straightforward: limit the trust in the CA to .BR domains. [domain name typo fixed]

Post by foota » Sun, Dec 01, 2024, 3:33 AM UTC

lxgr wrote: post #54

tptacek wrote: post #33

Earlier quoted context omitted.

Yes, if the interception system involved was meant only for resources within Brazil’s own agency networks.

But that's not allowed for publicly trusted roots under any circumstances, right? Not sure if that would qualify as an accident.

Post by kelnos » Sun, Dec 01, 2024, 3:41 AM UTC

amluto wrote: post #59

tialaramex wrote: post #13

Earlier quoted context omitted.

These are generally government CAs, so, typically the situation is Microsoft sold the government Windows, and as part of that deal (at least tacitly) agreed to the CA being trusted, and so every system that's trusting these certificates is a Windows PC anyway, running Edge because the whole point was the government will only use Windows and pays Microsoft $$$. Why bake it into everybody else's Windows? If you make sa…

The solution seems straightforward: limit the trust in the CA to .BR domains. [domain name typo fixed]

Post by lmm » Sun, Dec 01, 2024, 3:48 AM UTC

alganet wrote: post #43

move-on-by wrote: post #12

Earlier quoted context omitted.

Also being issued on a major US holiday- when many are on PTO- does not help with the look.

During carnival we brazillians often take 3 or 4 days leave. Would it be fair during that time if I asked you to hold your PRs, bug tickets and work in general because we're on paid leave? On-call rotation exists for those reasons. Otherwise, all countries would need to respect all other countries holidays. In fact, we're not even aware of most US holidays. It is likely to be a coincidence.

Post by Arrowmaster » Sun, Dec 01, 2024, 3:50 AM UTC

buzer wrote: post #42

zer0x4d wrote: post #34

Earlier quoted context omitted.

Nope, certificates are issued for CNs(Common Name), also known as FQDNs (Fully qualified domain names). Something such as *.google.com, not IP addresses. If they were issued for IP addresses they would have to reissue the certificate every time they spun up a new server. Also it's why if you spin up another server and make DNS point google.com to that server, it would not pass verification since the certificate you w…

Certificates can be issued to IP addresses (at least on SAN level, not sure if they are allowed in CN in CA/B baseline requirements), like https://crt.sh/?id=15492507462