2

As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker with a lot of money bribes a certification authority to issue a digital certificate that authenticates a fake server as "Google".

Are there laws to fine the certifying companies in case they act in bad faith by issuing false certificates? I know that legislations differ depending on the country, so let us focus at least in the United States.

closed as off-topic by Steffen Ullrich, Xander, schroeder Oct 20 '17 at 13:59

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm voting to close this question as off-topic because it is a purely legal question and thus should be better asked at law.stackexchange.com. – Steffen Ullrich Oct 20 '17 at 12:13
  • 2
    Apart from considering this question off-topic: I've never heard of a law specifically addressing bribing certificate agencies and I don't know if one is needed. Bribing, getting bribed and other forms of corruption are already unlawful in many countries. – Steffen Ullrich Oct 20 '17 at 12:15
  • as @SteffenUllrich says corruption is already illegal in many countries anyway. Plus as long as Google adheres to the rules of being a CA then whom they issue certificates to will be down to them, as far as I know there is nothing stopping Google doing as above, apart from they risk getting their CA roots removed by browsers (not that they would every do that!) – ISMSDEV Oct 20 '17 at 12:22
  • @SteffenUllrich Bribery is usually only a crime when you bribe a government employee. The vast majority of CAs are private. – Philipp Oct 20 '17 at 15:12
  • 1
    I don't know about laws, but there are certainly other consequences. In particular, if a CA did this and was discovered, they'd almost certainly have their root certs distrusted by browsers and thus would no longer be able to issue valid certificates to new sites. This is sometimes referred to as "the CA death penalty". – Ajedi32 Oct 20 '17 at 15:48