Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)

Question

I am researching the Equifax breach described here: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf

Apparently the attack went undetected for a long period of time and the main reason given for this are expired certifiates: Because of expired certificates, the Equifax IPS was unable to inspect encrypted traffic and detect the breach in time.

-- Edit, based on Steffen Ulrich`s response below --

Page 34 of the report gives some more details:

The expired SSL certificate was installed on a traffic monitoring device called an SSL Visibility (SSLV) appliance.195 This device allowed Equifax to inspect encrypted traffic flowing to and from the ACIS platform by decrypting the traffic for analysis prior to sending it through to the ACIS servers.196 Both the intrusion detection system and the intrusion prevention system were behind this monitoring device.

And further below on the same page:

The default setting for this device allowed web traffic to continue through to the ACIS system, even when the SSL certificate was expired. When this occurs, traffic flowing to and from the internet is not analyzed by the intrusion detection or prevention systems because these security tools cannot analyze encrypted traffic. According to documents obtained, the SSL certificate installed on the SSLV device monitoring the ACIS domain ai.equifax.com expired on January 31, 2016. As a result, Equifax did not have visibility into the network traffic in the ACIS environment for nineteen months

-- end of edit --

According to my research it should still be possible to decrypt data, even with an expired certificate. Consider for example this post here: https://stackoverflow.com/questions/28098470/no-error-encrypting-decrypting-data-with-an-expired-certificate-using-rsacrypt

I am not that familiar with IPS products and respective configuration possibilities, so I am a bit confused: What exactly is the issue with the expired certificate? Is the IPS checking the validitiy and in case the cert. is expired just refuses to decrypt traffic? If so it seems to be, that there should at least be an option to decrypt anyway and issue a warning to the whoever´s running the IPS. Is there such a thing?

Thanks for you insight and cheers

Answer 1

I suspect that the report is kind of misleading in claiming the expired certificate as the problem. A certificate can not be used to decrypt traffic at all but rather the private key matching the certificate is needed. This is at least true for the (obsolete) RSA key exchange which I assume was used here - for inspection with DH key exchange one would need instead need the pre-master secret of each TLS connection and neither certificate nor private key would be usable.

Thus the problem is likely not the expired certificate but instead that the private key installed on the device matched the public key in the expired certificate but not the one from the new certificate. This is likely because the new certificate did not reuse the key from the old certificate but instead a new key pair was created. For successful inspection the new private key matching the new public key in the new certificate had to be installed on the inspection device.