Background: As explained e.g. on this Google company blog, Google writes that:
On September 14, around 19:20 GMT, Symantec’s Thawte-branded CA issued an Extended Validation (EV) pre-certificate for the domains google.com and www.google.com. This pre-certificate was neither requested nor authorized by Google.
According to this newer Google blog entry, it looks like the issue of fake certificates has been even worse:
Symantec performed another audit and, on October 12th, announced that they had found an additional 164 certificates over 76 domains and 2,458 certificates issued for domains that were never registered.
It’s obviously concerning that a CA would have such a long-running issue and that they would be unable to assess its scope after being alerted to it and conducting an audit.
In that newer blog entry, Google states that they are requesting additional information from Symantec on how this could have happened.
However in their official report about this it looks like Symantec is downplaying the severity of creating these certificates. In the "Addendum - October 12, 2015" section (starting on p.4) the company refers to these as "test" certificates (emphasis mine):
On October 8, 2015, after follow-on questions from industry partners, we reopened our investigation, and identified a set of test certificates that were not included in our original analysis.
While our current investigation is ongoing, so far we have found 164 additional instances where test certificates were inappropriately issued. All of these test certificates have been revoked. These test certificates were spread over 76 domain owners whom we are in the process of contacting.
On p. 2 of the report (before this addendum section was added to it), Symantec says that:
Most importantly, these test certificates never posed a risk to anyone or any organization, as the certificates never left Symantec’s secure test labs or the QA test machine, and they were never visible to any end user. [...] One of these test certificates with a CN=www.google.com was an Extended Validation (EV) test certificate and was logged to public Certificate Transparency (CT) log servers which is standard practice by default for EV certificates issued by CAs. Logging to a CT server did not in any way make the test certificate usable – it was only detectable by CT monitors.
Above explanation seems(?) to clarify how Google was able to find out about the certificates (through the CT monitors) if they never left the Symantec test labs.
On one hand it looks like Google is making quite a big deal about this incident, while Symantec is acting like it was just some 'testing thing'.
The questions I would like to ask are however about this section in p.2 of the Symantec report...
The list of organizations impacted by these test certificates includes Google, Opera, and three (3) other organizations who have not requested or approved disclosure of their domains.
...and this section on the last page where the report says:
We have received requests from the Browser community for the certificate details so they can update their black lists accordingly. The certificate details are available here for their reference...
...after which the report provides two links:
- "List of Test Certs of Owned Domains", and
- "List of Test Certs of Unregistered Domains"
I am not sure but it seems that the domains of those 3 "other organizations" that did not want their domains disclosed would not be on the blacklist.
The questions are:
- Why would browser community need/want a blacklist if these "harmless" certificates never left the Symantec test labs?
- On another hand, if this is a more some serious thing, it would be helpful for browser users to have a blacklist of affected domains. In this case, why would 3 organizations not want their domains disclosed?
(Update: re-wrote the 2nd question to ask specifically about the reasoning why the 3 organizations might not want their domains disclosed.)
