DoD's public.cyber.mil is using an untrusted root CA
1–4 of 4 posts
Re: DoD's public.cyber.mil is using an untrusted root CA
#2DOD Cyber Exchange, home of DISA STIGs among other resources, appears to be signed by a root CA "US DoD CCEB Interoperability Root CA 2" which does not appear to be in any browser list of trusted root CAs. This seems to have changed at some point, because public.cyber.mil used to be accessible without any browser warnings. Certificate chain:
$ gnutls-cli --print-cert public.cyber.mil 443 Re: DoD's public.cyber.mil is using an untrusted root CA
#3https://usgovpki.apps.deas.ecs.mil/dod/cas-all-simple/index....
I don't know if their change was intentional but the DoD does publish their CAs for use. I also have to say that if you are blindly trusting the CAs that your browser includes to determine the legitimacy, authenticity or security of your data going to the target of your intention, you are in for a very rude awakening when you learn how they work and how most of them issue certificates.
The way most certificates are signed nowadays is only as strong as the DNS hijacking protection they have. Preloaded CAs make for an ease of browsing experience but protection they actually provide is only in the encrypted transit and not much beyond that.
Re: DoD's public.cyber.mil is using an untrusted root CA
#4https://usgovpki.apps.deas.ecs.mil/dod/cas-all-simple/index.... I don't know if their change was intentional but the DoD does publish their CAs for use. I also have to say that if you are blindly trusting the CAs that your browser includes to determine the legitimacy, authenticity or security of your data going to the target of your intention, you are in for a very rude awakening when you learn how they work and how…
This is fair, but I would venture to guess 99% of people including software developers and even most IT professionals completely rely on the vendor pre-installed root CAs.