Organization XYZ prefers not to trust any CA but only itself. It has set of certificates which are physically stored on each client and server which are trusted again only by their Enterprise CA. All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.

All other programs (Java, Node.js, .NET, etc.) keep subset of required certificates and use them to connect each other.

What is wrong with this picture? What arguments should be used to convince management to use common practice?

After all management says - we trust each other and those who want to work with us should trust us. There is no other way to communicate for us.

Question clarification: Maybe I'm wrong but I feel that explained solution is wrong. I just cannot convince management that this is wrong and I asked community to give me some arguments.

Personally (taking in account described in answers extra cost) I see only one problem - since all external sites are already marked as not private/dangerous regular user will pay no attention to such warning. It became not warning but common knowledge that web is dangerous and surfing is your own risk. Worst part - we trust only internal net but since individual computers are more vulnerable any break to any computer will expose entire internal network since it trust itself.

Actually, to be honest, that's not my problem at all. My problem is that when I try to use any other standard approaches or programs (like example Node.js tries to reach internal web api) it (as honest program) says - "self signed certificate in local chain" and refuses to access this connection. So, for me it's nightmare (or actually cost) to find solution for each program (Node.js, Java, VuGen, QTP, .NET, etc) obtain certificates and keep them in sync.

My question is what are the arguments I can use to convince management that this solution is wrong.

  • 3
    I am sorry but I am unable to relate your question to the title. Can you please elaborate what "physically exchanging certificates instead of handshake" mean in terms of having your own CA and the certs signed by them? – Limit Dec 15 '16 at 4:07
  • Do you mean "manually" instead of "physically"? What's the security implication here? – schroeder Dec 15 '16 at 8:02
  • Certificate files are stored on each computer. There is file/storage which should be updated to add new certificates. Every client and server should do it. You can call it manual or physical. Certificates are all kinds from self signed to real (like bought from Verisign). – Alex Dec 15 '16 at 11:45
  • The "edit" function not only allows you to add content to the question, but also remove. If at 80% you claim "Actually, to be honest, that's not my problem at all." then don't write about what's not your problem. Write only what is your problem and ask a clear question. – techraf Dec 16 '16 at 22:45

Organization XYZ prefers not to trust any CA but only itself.... All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.

What is wrong with this picture?

What's wrong is that Organization XYZ is using the wrong enforcement point.

If they don't trust the outside world, then they should remove outbound web proxies and ensure firewall rules disallow all access outbound on ports 80/443.

Or they could implement a draconian proxy with TLS MITM which limits access to only those external sites they consider legitimate. (And if they do that, of course, they should again trust the outside certificate authorities, as access to approved sites is being enforced by the proxy, not at the TLS certificate layer.)

If Organization XYZ isn't willing to take these - admittedly quite drastic - steps, then they need to seriously reconsider why they're stigmatizing what is - by their own admission - acceptable access. Because by distrusting all other CAs, they're placing Extended Validation certificates on the same level as Self-Signed Snakeoil certificates. If you're going to throw that away, you should just block everythi.... oh, wait, that was step 1.

  • 1
    All is correct. Some sites are blocked and the rest has warning that connection is not private. In my understanding they switch responsibility from common CA to average Joe Shmoe who does web surfing to determine that is site secure/authentic or dangerous. I know this is wrong but I cannot find simple words to explain this to the managers. – Alex Dec 15 '16 at 12:03
  • @Alex: from a manager point of view every non professional site is dangerous because while you are visiting it you are not working for him/her. – Serge Ballesta Dec 15 '16 at 12:35
  • @Alex the average Joe Schmoe is not at all qualified to determine whether a site is secure or dangerous. Doing this would require them (at the very least) to be able to recognize a trustworthy CA certificate. Off the top of your head, which should you trust: a cert for "AddTrust External CA Root" with the SHA1 fingerprint C459321B6B265D4F76BBBAE5EA4F11F61B105E70, or one with the fingerprint 372B84DAAEE822F8AD00DAF117742CAE52E181C0? If you don't know, you're not going to be able to tell the difference between a trustworthy cert and a completely faked one. – Gordon Davisson Dec 17 '16 at 7:28
  • @sergeballesta I humbly submit that my manager is not qualified to determine which sites do or do not enhance my productivity, and if he doesn't trust me to be responsible with my time, he has bigger problems than completely breaking the chain-of-trust mechanic of SSL certificates. – Shadur Dec 18 '16 at 11:38

There are two parts in your question:

Is it wrong to use an internal CA inside an organization?

Nothing is wrong here, provided the delivery process of certificates is correct. That supposes that machines certificates are only established at the proper administrative level, and only installed on machine by the administrators and nobody else can steal them. That also supposes that if certificates are delivered to employees or partners, there is some information on their usages and the process ensures that they can only be used by the correct person.

It saves some money at the cost that the certicates are not trusted in the external world. It would be problematic for Business to Client processes, but is fine for internal exchanges or exchanges with a limited number of known partners

Is it wrong to remove all default certificates from internal browsers?

It is weird unless internal machines are not allowed to access the global internet. If the internal network if physically isolated from internet accesses or if a proxy blocks everything except for a small number of machines, the other certificates are just useless and can be removed... even if it provides no additional security.

If employees are allowed to access the internet removing the certificates can avoid automatic installation of plugins signed from well known sources, but at the cost of a high number of false positives. The risk here is to instruct users to accept any new certificate without even reading the message, which can be worse. So IMHO it only makes sense if the users cannot by-pass the untrusted status of external certificates.

But as long as the machines belong the employer, he can choose what can be installed or not on them, and what they can be used for... even if removing default certificate may not be the better way and cannot be the only one.

Limits of private certificate

Private certificate are fine for authentication or for crypting data exchanges. Typically, they are perfectly fine for HTTPS.

But you cannot use them for non repudiation, at least with smartcards (*). If you issue and deliver a certificate, you will never be able to prove that you have never kept a copy of the private key. No legal court will accept that because you have an interest here. That is the reason why non repudiation is better validated through a third party issuer.


(*) As said by @AndréBorie, this does not apply if only a CSR was exchanged, but only if you provide a smartcard

  • Is it really fine? Certificates are for servers. I do not know is it valid scenario but here is imaginary situation: Server A has applications X,Y,Z. Client machine has certificate to server A. Does it mean that client can connect to all X,Y,Z or, at least, eavesdropping and decrypt all traffic for all 3 applications from A? – Alex Dec 15 '16 at 12:10
  • The owner of a certificate can decrypt the traffic, full stop. At that point the fact that the CA is local or not does not matter. – Serge Ballesta Dec 15 '16 at 12:33
  • Certs are not just for servers. What they are saying is that they don't trust any of the public CA infrastructures and prefer to rely on people adding trust by hand. A rather bizarre paranoia. – Julian Knight Dec 15 '16 at 20:33
  • Why is non-repudiation a problem? Delivering a cert doesn't mean you also have the private key. The key is always kept by whoever requests the cert, and he only sends you a CSR, to which you reply with a cert. No private key is ever exchanged. – André Borie Dec 16 '16 at 10:40
  • You are right. I was thinking of certificate on smart cards. If you deliver the smartcard, at one moment the card was in your possession, so you cannot use it as a legal proof. – Serge Ballesta Dec 16 '16 at 10:46

If I've read this correctly, I'd say that the thing that is wrong is that staff are wasting time manually applying certificate trust instead of letting the browser and external Public Key Infrastructures do their stuff.

While it is true that the certificate trust model is badly broken, it does mostly work. At least as long as you require the browser to check certificate validity & keep the browser patched (so that root CA trusts can be rapidly updated).

Do you really want to rely on individual staff to do what the browser can do? What overheads does that bring? Those overheads translate into cost which is how you would convince "management" to change their minds.

  • In a large organization there is no additional cost, because new machines are always prepared by the support team to install the required softwares, remove the unwanted ones, correctly declare them in the network (Active Directory inscription, IP addresses, proxies, DNS settings, etc.). The cost of the installation of a new root CA is neglegtible. But it does add constraints for partners which is IMHO the only correct attack point, even if OP has already said that management knows it and does not care for. – Serge Ballesta Dec 16 '16 at 8:54
  • OK, but there is a cost. Support is not free. The cost of support and maintenance should be taken into account. Often management accept something because they are not aware of all of the costs and risks. On risks for example, how does the organisation actually prove that their scheme is more secure? Has that been tested? – Julian Knight Dec 16 '16 at 9:09
  • Of course support has a cost! And leaving employees without support has one too. It is the management role to tell what is the support/admin responsability and what is the user responsability. As far as I am concerned, I would never allow an average employee to do administrative tasks on his/her machine, and the initial setting is an administrative task. What I say is that the marginal cost of adding a root CA is neglegtible for a large organization, but that it could not the same for all its partners. – Serge Ballesta Dec 16 '16 at 9:22

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.