Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them with fraudulent certificates enabling the adversary to perform a MITM attack against all visitors to that website.

Is this correct, or do protocols such as SSL and S/MIME protect in some way against this major flaw? If so, how do they protect against it?

If my understanding is correct, and this type of attack is possible, is there anything stopping organisations such as the NSA from compelling a CA such as Versign to issue them with duplicates of all certificates, and performing a general MITM attack against all SSL secured websites (and S/MIME emails, etc)?

share|improve this question
A CA breach that resulted in the issuance of fake Google certs: – apsillers Jun 30 '13 at 1:14
In a word: Yes. – tylerl Jun 30 '13 at 7:07
This is precisely why decentralized trust systems are so necessary, e.g., the blockchain-base‌​d DNSChain. – Geremia Sep 12 '15 at 3:49
up vote 10 down vote accepted

Yes, a nation-state adversary can get a valid certificate for any site from any CA which they have power over. Whether it's legal or not is probably another question which I'm not qualified to answer.

Keep in mind that, even if a hijacked CA starts signing certificates with CNs of popular websites like in order to MITM their traffic, it will be a different certificate and thus a noticable change. One can essentially notice this change by some form of "pinning" -- i.e., associating a specific certificate or public key with a specific website.

Basic vendor-supplied pinnings have existed in Chrome for a while, but now we're seeing more interesting solutions such as TACK and Public Key Pinning, which aim to make it possible for any server admin to temporarily pin keys to their domains.

share|improve this answer
Is there any reason why it would have to be a different cert? In other words, couldn't the CA issue identical certs to both Google and the NSA (for example)? Such as by duplicating the cert when they originally generate it, and handing a copy to the NSA? Clearly this would require prearrangement, but is there any technical reason why it wouldn't be possible? (Also, if you could go into more detail about "interesting solutions such as TACK and Public Key Pinning, which aim to make it possible for any server admin to temporarily pin keys to their domains", that would be great.) – Caesar Jun 30 '13 at 1:39
CAs do not give out private/public key pairs. They sign them. The CA never sees the private key of the certificate, all they see is the Certificate Signing Request. So the NSA would not be able to get the private key from the CA. – Darius Jahandarie Jun 30 '13 at 2:33
Ah yes, of course, my mistake. Still, I guess they could get hold of the private key of a specific site by subpoenaing the operators of the site for it (and requiring them not tell anyone). But at least this can't be done as a "generic" attack on all sites. – Caesar Jun 30 '13 at 3:51
I would suggest that you may want to change the answer from yes, to kind of. You answer that yes they can mitm, but then you explain why it would be noticeable to anyone that has been to the site before, which really means that no, it can't MITM, at least not for all cases. – AJ Henderson Jun 30 '13 at 4:47
@AJHenderson Good point, thanks; I clarified the opening sentence. – Darius Jahandarie Jun 30 '13 at 5:02

The EFF's SSL Observatory has generated a map of all Certificate Authorities. This map is so massive, there is a very high likelihood that one of these is compromised at any given time. The principle of the weakest link makes me quite wary of our PKI. Furthermore, it is trivial for a nation-state to afford that cost of becoming a delegate authority.

A good defense against the broken nature of our PKI is certificate pinning.

share|improve this answer
Ironically, I got an SSL error when visiting the page, but I'm on an old XP netbook at the moment. – Manishearth Jul 1 '13 at 3:47

It depends if the CA is behaving properly when issuing certificates and if the person has been to your site before. If a CA is behaving properly when you get your certificate, they should not keep your private key. In fact in many cases, you can actually form your own private key if you wish.

Provided that you have the only copy of the private key, all the CA can do is issue another certificate (for a different private key) that will be trusted as your domain. Any CA could in fact do this. It doesn't have to be yours. It just has to be some CA that is trusted in your visitor's browser.

However, when someone first visits a site protected with SSL, the browser remembers the fingerprint of the certificate. If the SSL cert changes from one visit to another, then the browser should give a warning. Thus, if a government entity gets a certificate signed by a trusted CA saying that it is your domain, it would still have a different fingerprint and while new users wouldn't be aware of them being in the middle, any previous users should be able to detect the man in the middle attack.

share|improve this answer
Most browsers do not actually give warnings for certificate changes. – Darius Jahandarie Jun 30 '13 at 5:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.