Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I received a message 'The identity of this website has been verified by Google Internet Authority G2 but does not have public audit records.'

What exactly does it mean that the certificate does not have public audit records? Are their certain threats a site using a certificate without public audit records has that a site using a certificate with public audit records does not?

share|improve this question
2  
I see you had to take a screenshot to export the message. If you think it should be easier to copy the connection information out of Chrome, vote for code.google.com/p/chromium/issues/detail?id=254249 –  Colonel Panic Sep 5 at 10:57
    
Has anyone found an example with public audit records? –  Colonel Panic Sep 12 at 16:19
1  
For an example with public audit records, see embed.ct.digicert.com . It's a purpose test site. Perhaps we'll see transparency proofs on real sites (most likely Google and Twitter) next year. –  Colonel Panic Oct 22 at 17:26
    
Or digicert.com , the certificate for that other site has expired. –  Colonel Panic Nov 7 at 15:16

2 Answers 2

up vote 57 down vote accepted

This has to do with the concept of Certificate Transparency.

The Problem

Browsers currently trust certificates if four conditions are met: (a) the certificate is signed by a trusted CA, (b) the current time is within the valid period of the certificate and signing certs (between the notBefore and notAfter times), (c) neither the certificate nor any signing certificate has been revoked, and finally, (d) the certificate matches the domain name of the desired URL.

But these rules leave the door open to abuse. A trusted CA can still issue certificates to people who shouldn't have them. This includes compromised CAs (like DigiNotar) and also CAs like Trustwave that issued at least one intermediate signing certificate for use in performing man-in-the-middle interception of SSL traffic.

In these cases, a key factor is that the signing behavior of the CA is not auditable. You won't know that Trustwave or DigiNotar has issued a fraudulent certificate until you actually see the certificate, in which case you're probably not someone who can actually do any real auditing. In order to audit signing behavior, we need CAs to make the certificates they sign public.

The Solution

The way we deal with this is to create a log of issued certificates. This can be maintained by the issuer or it can be maintained by someone else. But the important point is that (a) the log can't be edited, you can only append new entries, and (b) the time that a certificate is added to the log is verified through proper timestamping. Everything is, of course, cryptographically assured to prevent tampering, and the public can watch the contents of the log looking to see if a certificate is issued for a domain they know it shouldn't have.

If your browser then sees a certificate that should be in the log but isn't, or that is in the log but something doesn't match (e.g. the wrong timestamp, etc), then the browser can take appropriate action.

What you're looking at in Chrome, then, is an indication as to whether a publicly audible log exists for the certificate you're looking at. If it does, Chrome can also check to see whether the appropriate log entry has been made and when.

This technology is relatively new and isn't yet widely deployed, but it promises to provide greater transparency for CAs and should help establish trust where trust is due, and cast doubt where trust is not assured.

share|improve this answer

This is a project by Google called Certificate Transparency that attempts to fix flaws with the SSL certificate system.

It essentially has three main goals. (Lifted from http://www.certificate-transparency.org/what-is-ct)

  • Make it impossible (or at least very difficult) for a CA to issue a SSL certificate for a domain without the certificate being visible to the owner of that domain.
  • Provide an open auditing and monitoring system that lets any domain owner or CA determine whether certificates have been mistakenly or maliciously issued.
  • Protect users (as much as possible) from being duped by certificates that were mistakenly or maliciously issued.

Source: http://www.certificate-transparency.org/certificate-transparency-in-chrome

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.