In what situations can SSL keys be "forged" and what does that mean?

Question

Quotes from @devknoll referencing Patribotics:

Not a mirror. It's signing SSL using same certs as http://wikileaks.org for goodness sakes.

1. Do mirrored or load-balanced sites not share the same SSL key? Is the author claiming something like: "If a site that isn't Wikileaks, appears to have the Wikileaks SSL private key, something shady is going on?" Or have I misunderstood? The author is referencing that when they did a dig wikileakgs.org the below two of the IPs linked to that domain were called into question (note: I don't understand why, hence the thread). (Edit re: these hosts added at bottom of thread.)

   wikileaks.org.          600     IN      A       141.105.65.113
   wikileaks.org.          600     IN      A       141.105.69.239
   

2. I'm confused by both statements:

   Best case scenario, keys aren't physically there (but bad actor can still forge)

   Worst case scenario: Bad actor can decrypt anything. If WL was your bank, this server can take money

3. Is this because they appear to have a SSL key that they shouldn't? How does one tell if a web server is a separate entity, and not just load-balancing (on behalf of Wikileaks, as in this example)?

Edit--

One big issue, that I can identify, is as follows: Wikileaks is hosted by Swedish ISP Bahnhof, in the Pionen facility. However, when users did a whois 141.105.69.239, they got this response:

organisation:   ORG-MTL21-RIPE

org-name:       Mir Telematiki Ltd

org-type:       LIR

address:        Barabannii pereulok 4/4

address:        107023

address:        Moscow

address:        RUSSIAN FEDERATION

phone:          +7 495 369 9796

fax-no:         +7 495 369 9796

mnt-ref:        MTLM-MNT

mnt-ref:        RIPE-NCC-HM-MNT

mnt-by:         RIPE-NCC-HM-MNT

mnt-by:         MTLM-MNT

abuse-mailbox:  [email protected]

abuse-c:        HA2800-RIPE

created:        2010-10-06T10:46:46Z

last-modified:  2016-09-30T12:14:19Z

source:         RIPE # Filtered

I am now thinking, that this host being owned by a Russian provider (who Patribotics associates with Russian hacking communities -- potentially an entirely separate issue), and not being owned by the Swedish ISP or a reputable CDN... perhaps is the issue?

Answer 1

Do mirrored / load-balanced sites, not share the same SSL key?

A mirror site usually refers to a server with a different hostname which mirrors the information located at the original server. But I think you are referring to the case where different servers share the same hostname in DNS. In this case it is common that they share the same certificate and thus key pair but it might also be that different certificate (with different key pairs) for the same hostname are in use.

But, commonly servers sharing the same hostname in DNS are managed by the same entity which owns the key pair. In this specific case this might be different, i.e. different parties managing the servers. In this case sharing the key would not be a good idea for security reasons. But there are not enough information if this is really the case here.

Best case scenario, keys aren't physically there (but bad actor can still forge)... Worst case scenario: Bad actor can decrypt anything. If WL was your bank, this server can take money

I think they are assuming here that the servers are managed by different parties but use the same certificate.

The worst case scenario is then that the secret key is shared between all these parties so that they can use the same certificate. This means that any of the parties could also hijack any of the traffic by the other server if the same certificate is used. While this does sound bad it might not be that bad if the key is only used for this certificate and if the information on all sites are the same anyway and if no sensitive data are sent by the client which others should not see. This might actually the case for wikileaks.

Another option to deal with this case is to not share the private key but to defer part of the SSL handshake to a single party which has the private key. See keyless SSL from Cloudflare for more details on how this can be done. In this case the private key is not shared but the above man in the middle attack against any other site with the same certificate can be done anyway. The main advantage is that there is less chance that a party gets compromised and thus the private key leaks to yet another party.

How does one tell if a web server is a separate entity, and not just load-balancing (on behalf of Wikileaks, for this example)

You cannot tell from outside. A separate server is a separate entity in any case but you don't know if it is managed by the same or another person and even if it looks like all servers have the same content there might be subtle differences or they might serve completely different content tomorrow.