How is HTTPS protected against MITM attacks by other countries?

Question

HTTPS relies on server certificates to ensure you are connected to the correct server and thus thwart man-in-the-middle attacks.

Nowadays, there are countless certification authorities in many countries around the globe. What is preventing a country from forcing a certificate authority located in the country to issue fake server certificates for the purpose of mounting man-in-the-middle attacks, including attacks on servers located in other countries?

If there is no safeguard against this, is HTTPS still safe? After all, it means anyone with connections to a rogue country can eavesdrop on any HTTPS traffic, by procuring fake certificates via that country...

Answer 1

Certificate Transparency

The Certificate Transparency standard requires that when a certificate is issued, it should also be submitted to one or more Certificate Logs. These are simple network services that maintain cryptographically assured, publicly auditable, append-only records of certificates. Once a certificate has been added to a Certificate Log, an independent monitor can check the log to ensure that no fraudulent certificate has been issued. These days browsers require all certificates to have a Signed Certificate Timestamp (SCT) either in a TLS extension or through OCSP stapling, which is used to establish that the certificate has been added to a Certificate Log. Most browsers require the certificate to be present in more than one log (Chrome requires at least two, for example). If the SCT is missing, the certificate is rejected. This ensures that whenever any root/intermediate CA starts issuing fraudulent certificates, the monitors will notice and raise a red flag. Then either the CA revokes the certificates, or browsers stop trusting that particular CA.

In the past, HTTP Public Key Pinning was used. This involved the browser saving the public key(s) of a site the first time it was visited, and if the keys suddenly changed, the browser would refuse to connect. Dynamic pinning, which allows any site to be pinned at the first visit, has now been deprecated. However, static pinning, in which browsers ship with hardcoded public keys for popular domains like google.com and facebook.com, is still used. This can also be used to detect MITMs with fraudulently issued certificates, if the MITM targets any of these popular domains.

Answer 2

The trust stores of major browsers (at least: Chrome, Firefox, Safari, Edge and Brave) at all cost avoid certificate authorities which could potentially be controlled by governments.

There once was an attempt by the government of Kazakhstan to add their official root certificate to the trust chains. It ultimately failed exactly due to the trust issues. Nowadays, chances even for a private company from a country with a heavy governmental influence on the economy (like Kazakhstan or Russia) to successfully commit their certificate to the public trust stores are basically nil.

Moreover, more than once Mozilla and other vendors explicitly banned (i.e. you cannot accept it on a page even if you want to) even the untrusted root certificate issued by Kazakhstan for MITM attacks. So even if, say, the potentially evil government of Valencia, Spain (for your information, their own root certificate is now present in your trust store — see) decides to eavesdrop on its users, such an attempt would cause the exclusion of their certificate from browsers, and pretty quickly.

Then it all comes down to risk modelling. Probably the governments would only risk the exclusion of their local certificate authorities if the stakes are high, e.g. they are chasing a notorious terrorist or a famous dissident. However, such people would probably use stronger privacy protection methods anyway.