3

As hinted at in Does any technology prevent a CA unilaterally revoking a certificate?, I'm a little uncomfortable with the possibility that CAs effectively licensing a website to operate (given the de facto deprecation of unencrypted HTTP).

Are there any obligations on a CA to issue a certificate if the requesting entity provides the necessary level of identity verification?

Improve this question
7
  • 1
    The CAs can choose themselves with whom to make business. They aren't obliged to do anything.
    – SEJPM
    Mar 22, 2016 at 18:20
  • @SEJPM That was my assumption, but I'd hoped given the policy decisions by the IETF and browser vendors around TLS for HTTP/2 that safeguards were in place.
    – Phil Lello
    Mar 22, 2016 at 18:28
  • Can you elaborate on what safeguards you expect?
    – Mike Ounsworth
    Mar 22, 2016 at 18:28
  • It seems like you're creating a "Who watches the watchers?" scenario. The answer is: auditors. CAs fear the all-mighty auditor!
    – Mike Ounsworth
    Mar 22, 2016 at 18:48
  • 1
    Interesting question... with no obligation and increasing economic consequences of political and social trends it would seem reasonable that CAs could pick and choose their customer's and, as a result, ensure any particular population was exposed to increased digital surveillance and risk... tyranny of the majority via technical handicap. The continuance of encryption wars and net neutrality.
    – Dave
    Mar 22, 2016 at 20:54

1 Answer 1

Reset to default
4

Good question.

You are paying the CA for the service of verifying your CSR against public records, and putting their reputation on the line for you. I'm not sure if a CA is contractually obliged to provide you service. Is a lawyer required to represent you in court as soon as you walk into their office?

I would assume that a CA has the authority both to:

  1. Refuse to certify any CSR for any reason they see fit.
  2. Revoke any certificate at any time, for any reason they see fit.

I can see why this would cause some public concern in a post-Snowden world. Let me assure you that (to the best of my knowledge) CAs are private companies acting out of their own economic self-interests with no government affiliations, and that the public SSL roots are routinely audited by many industry and multi-national government panels looking for that kind of fraud. A CA that is caught doing something dirty will go out of business very very quickly.

As @Matthew said in the top answer to the linked question, the whole system works on

Peer pressure, effectively.

[Disclaimer since I've been accused of bias before; I work for a CA]

Although it's not in your question, I would like to draw a distinction between Domain Validated certs and Extended Validation certs.

A DV cert will cost you 0$ - 5$, and the issuance is completely automated: you just need to prove that you own the DNS registry, and that you can place a file on the server that responds to that IP address. While there is no guarantee that this is free of political influence, it's pretty safe.

EV certs involve humans and paperwork and phone calls and stuff. This is the one where your suspicions might be justified.

Given that DV certs are so easy to get, your fear that a CA (or political consortium of CAs?) can de facto block a website from operating is not really justified - as long as you're ok with the plain-old-padlock, not the super-green-bar.

Improve this answer
4
  • 2
    My concern is that the in the rush to take control away from governments (who in theory are answerable to their population), it's being given to private companies answerable only to their share holders. Is a conspiracy amongst CAs inherently less plausible than a conspiracy amongst intelligence agencies? Note that I consider this a risk for the future, and have no reason to believe it already happens.
    – Phil Lello
    Mar 22, 2016 at 19:00
  • Yup, I certainly respect your Snowden-esque mistrust of authorities! This is a good question to be asking for sure.
    – Mike Ounsworth
    Mar 22, 2016 at 19:01
  • 1
    On a related note, community.letsencrypt.org/t/… is interesting reading - given the priority given to ssl sites by search engines, it appears the attempt has already been made
    – Phil Lello
    Mar 23, 2016 at 21:43
  • That is interesting, thanks for sharing. So the US does force CAs to play politics with who they issue to.
    – Mike Ounsworth
    Mar 24, 2016 at 2:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .