What is wrong with physically exchanging certificates instead of handshake?

Question

Organization XYZ prefers not to trust any CA but only itself. It has set of certificates which are physically stored on each client and server which are trusted again only by their Enterprise CA. All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.

All other programs (Java, Node.js, .NET, etc.) keep subset of required certificates and use them to connect each other.

What is wrong with this picture? What arguments should be used to convince management to use common practice?

After all management says - we trust each other and those who want to work with us should trust us. There is no other way to communicate for us.

Question clarification: Maybe I'm wrong but I feel that explained solution is wrong. I just cannot convince management that this is wrong and I asked community to give me some arguments.

Personally (taking in account described in answers extra cost) I see only one problem - since all external sites are already marked as not private/dangerous regular user will pay no attention to such warning. It became not warning but common knowledge that web is dangerous and surfing is your own risk. Worst part - we trust only internal net but since individual computers are more vulnerable any break to any computer will expose entire internal network since it trust itself.

Actually, to be honest, that's not my problem at all. My problem is that when I try to use any other standard approaches or programs (like example Node.js tries to reach internal web api) it (as honest program) says - "self signed certificate in local chain" and refuses to access this connection. So, for me it's nightmare (or actually cost) to find solution for each program (Node.js, Java, VuGen, QTP, .NET, etc) obtain certificates and keep them in sync.

My question is what are the arguments I can use to convince management that this solution is wrong.

Answer 1

Organization XYZ prefers not to trust any CA but only itself.... All inside Browsers are set to trust this Enterprise CA. So, naturally, all other web sites (like Google) are not trustworthy which is indicated by browser.

What is wrong with this picture?

What's wrong is that Organization XYZ is using the wrong enforcement point.

If they don't trust the outside world, then they should remove outbound web proxies and ensure firewall rules disallow all access outbound on ports 80/443.

Or they could implement a draconian proxy with TLS MITM which limits access to only those external sites they consider legitimate. (And if they do that, of course, they should again trust the outside certificate authorities, as access to approved sites is being enforced by the proxy, not at the TLS certificate layer.)

If Organization XYZ isn't willing to take these - admittedly quite drastic - steps, then they need to seriously reconsider why they're stigmatizing what is - by their own admission - acceptable access. Because by distrusting all other CAs, they're placing Extended Validation certificates on the same level as Self-Signed Snakeoil certificates. If you're going to throw that away, you should just block everythi.... oh, wait, that was step 1.

Answer 2

There are two parts in your question:

Is it wrong to use an internal CA inside an organization?

Nothing is wrong here, provided the delivery process of certificates is correct. That supposes that machines certificates are only established at the proper administrative level, and only installed on machine by the administrators and nobody else can steal them. That also supposes that if certificates are delivered to employees or partners, there is some information on their usages and the process ensures that they can only be used by the correct person.

It saves some money at the cost that the certicates are not trusted in the external world. It would be problematic for Business to Client processes, but is fine for internal exchanges or exchanges with a limited number of known partners

Is it wrong to remove all default certificates from internal browsers?

It is weird unless internal machines are not allowed to access the global internet. If the internal network if physically isolated from internet accesses or if a proxy blocks everything except for a small number of machines, the other certificates are just useless and can be removed... even if it provides no additional security.

If employees are allowed to access the internet removing the certificates can avoid automatic installation of plugins signed from well known sources, but at the cost of a high number of false positives. The risk here is to instruct users to accept any new certificate without even reading the message, which can be worse. So IMHO it only makes sense if the users cannot by-pass the untrusted status of external certificates.

But as long as the machines belong the employer, he can choose what can be installed or not on them, and what they can be used for... even if removing default certificate may not be the better way and cannot be the only one.

Limits of private certificate

Private certificate are fine for authentication or for crypting data exchanges. Typically, they are perfectly fine for HTTPS.

But you cannot use them for non repudiation, at least with smartcards (*). If you issue and deliver a certificate, you will never be able to prove that you have never kept a copy of the private key. No legal court will accept that because you have an interest here. That is the reason why non repudiation is better validated through a third party issuer.

---

(*) As said by @AndréBorie, this does not apply if only a CSR was exchanged, but only if you provide a smartcard

Answer 3

If I've read this correctly, I'd say that the thing that is wrong is that staff are wasting time manually applying certificate trust instead of letting the browser and external Public Key Infrastructures do their stuff.

While it is true that the certificate trust model is badly broken, it does mostly work. At least as long as you require the browser to check certificate validity & keep the browser patched (so that root CA trusts can be rapidly updated).

Do you really want to rely on individual staff to do what the browser can do? What overheads does that bring? Those overheads translate into cost which is how you would convince "management" to change their minds.