15

While browsing some US military and governmental sites, I noticed their HTTPS connection to rely on DoD Root Certificates. As most of us know, web browsers are pre-loaded with a default set of root certificate authorities which usually does not include the DoD Medium Assurance and Class 3 Root Certificate Authorities among its list of Intermediate and Trusted Root CAs. As a result, web browsers do not recognize the DoD as the Certificate Authority and pop up according warnings.

As most related sites show and explain (eg at http://mrmc.amedd.army.mil/index.cfm?pageid=ssl and/or http://www.dau.mil/faq/pages/dodcerts.aspx and/or http://www.forge.mil/Faqs.html#faqs14) the expected certificate(s) can be installed manually or via an install tool; but that obviously expects the user to put in time and efforts, while fiddling with things I personally wouldn’t expect a “user/client” to have to fiddle with in the first place. Especially, since downloading the root certificate (or using the installers) seems to be open to several (MitM) attack vectors.

At first glimpse, this doesn’t seem to be all too different from creating your own root certificate and forcing your users to download and install your self-signed certificates so that they can browse your (civilian) website securely and without nagging warnings. Normally people thinking along these lines are trying to be – let’s just call it – “cheap”, but I doubt that’s a valid reason when we’re talking about US military sites. I bluntly assume that the DoD doesn’t have money problems that would prevent them from buying certificates from well-established CAs (like the rest of us do).

This makes me wonder… what are the potential advantages for an organization like the DoD that might explain why they’re using their own root certificate(s)? Or – looking at it from another angle – are there any disadvantages if an organization like the US Department of Defence would rely on the typically known and used “public” Root CAs?

6
  • 2
    Related
    – SEJPM
    Jan 7, 2017 at 14:23
  • From what I can identify there's indeed no official USG CA in the Mozilla trust store but at least in the Apple one and in the Microsoft one. However those seem unrelated to the DoD one you found.
    – SEJPM
    Jan 7, 2017 at 14:30
  • My first (and questionable) thought was that DoD didn't want to be dependent on the independent Root CAs. Jan 8, 2017 at 14:31
  • 2
    yes i'd guess it's probably that they simply want more control over their security. the security of HTTPS is dependent on your certificate authority not being breached. did you notice that google also use their own certificate authority ? Jan 9, 2017 at 14:43
  • 1
    They also use smart cards for (physical) access control. With those certificates you do not want to be dependent on the security of some (civilian) third party.
    – Hacktiker
    Jan 12, 2017 at 18:17

2 Answers 2

5

They do rely on generally available CA root certs for sites that are expected to be generally avaiable to the public over HTTPS. See https://www.army.mil for one prominent example.

However, the DoD has a significant internal CA infrastructure and they perfer to leverage that instead for sites that either aren't intended to be served over HTTPS at all (like your https://mrmc.amedd.army.mil/ example, where HTTPS requests are simply 30x'ed back to http) or sites that are designed for internal use by folks on DoD equipment like http://www.dau.mil (which requires a CAC [DoD-issued smartcard] for authentication as well) or http://www.forge.mil/.

-4

The DoD - and other government agencies - do typically create their own security realm (certs, smart-cards, dongles, etc .) in order to implement rapid security containment protocols.

1
  • 3
    Welcome to the site. But please note that we require people to put a bit more work into their answers here. What is a "rapid security containment protocol" and how does maintaining an own certificate authority help with it? These are things which are not obvious to the reader and require an explanation.
    – Philipp
    Jan 12, 2017 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .