27

HTTPS relies on server certificates to ensure you are connected to the correct server and thus thwart man-in-the-middle attacks.

Nowadays, there are countless certification authorities in many countries around the globe. What is preventing a country from forcing a certificate authority located in the country to issue fake server certificates for the purpose of mounting man-in-the-middle attacks, including attacks on servers located in other countries?

If there is no safeguard against this, is HTTPS still safe? After all, it means anyone with connections to a rogue country can eavesdrop on any HTTPS traffic, by procuring fake certificates via that country...

4
  • 3
    There are safeguards, besides the Certificate Transparency described in one answer, you have CAA records in the DNS (with the caveat they apply at validation time, not at use time) and TLSA records (which unfortunately are not used very much by browsers). Both needs DNSSEC to be useful. And things can also improve in the future maybe with HTTPS/SVCB records. On the browser side you can implement TOFU principle with extensions like CertPatrol that will warn if the certificate (like its CA) changes from one visit to another. Dec 31, 2020 at 0:55
  • If you suspect you might be tracked by hostile regimes, you should be using an extra layer on top of HTTPS - VPN or TOR. Dec 31, 2020 at 2:06
  • 1
    @JonathanReez VPNs and TOR don't really help with this problem, they just move it. Instead of being vulnerable to attack at your actual (network) location, you become vulnerable to attack at the location of the VPN server/TOR exit node. (They do hide your actual location, but that's not the question here.) Dec 31, 2020 at 22:22
  • It's Tor, not TOR.
    – forest
    Jan 2, 2021 at 3:12

2 Answers 2

33

Certificate Transparency

The Certificate Transparency standard requires that when a certificate is issued, it should also be submitted to one or more Certificate Logs. These are simple network services that maintain cryptographically assured, publicly auditable, append-only records of certificates. Once a certificate has been added to a Certificate Log, an independent monitor can check the log to ensure that no fraudulent certificate has been issued. These days browsers require all certificates to have a Signed Certificate Timestamp (SCT) either in a TLS extension or through OCSP stapling, which is used to establish that the certificate has been added to a Certificate Log. Most browsers require the certificate to be present in more than one log (Chrome requires at least two, for example). If the SCT is missing, the certificate is rejected. This ensures that whenever any root/intermediate CA starts issuing fraudulent certificates, the monitors will notice and raise a red flag. Then either the CA revokes the certificates, or browsers stop trusting that particular CA.

In the past, HTTP Public Key Pinning was used. This involved the browser saving the public key(s) of a site the first time it was visited, and if the keys suddenly changed, the browser would refuse to connect. Dynamic pinning, which allows any site to be pinned at the first visit, has now been deprecated. However, static pinning, in which browsers ship with hardcoded public keys for popular domains like google.com and facebook.com, is still used. This can also be used to detect MITMs with fraudulently issued certificates, if the MITM targets any of these popular domains.

7
  • 11
    If $Dictatorship can strong-arm cert creation, they can probably strong-arm that that cert not be logged via the CTL. In the end, the only control is that the CA will get booted from trust lists after it gets caught through other means.
    – gowenfawr
    Dec 30, 2020 at 15:51
  • 7
    @gowenfawr I'm not a crypto expert so I don't understand the methods used very well, but as far as I know, it can be cryptographically verified that the CTL has logged the certificate, so if the certificate isn't added after the maximum merge delay, the CTL will also be caught and booted from the trust lists. Yes, the CA will only be booted after it is caught, but CT (and static pinning) is the mechanism in place to catch the CA.
    – nobody
    Dec 30, 2020 at 16:16
  • The certificate can be logged by the CA, but it can also be logged by a users’ webbrowser observing the certificate. I think Chrome does this. If a certificate remains unreported from the CA for a while, CA/B will start asking questions. They know this because a browser observing the certificate tattled. It’s easier for the nefarious party to just request the certificate and allow it to be logged; would you really notice if extra certificates with your domain were requested? I personally have no idea when renewals for my domains are due.
    – jornane
    Dec 31, 2020 at 9:50
  • @jornane CAs as well as other entities like CloudFlare and Google monitor CT Logs for discrepancies. And if you really think your domain is high value enough to be targeted by state-sponsored attackers, you can set up your own CT monitor. (By the way, your domain has an expired certificate and no HSTS so it doesn't matter anyways :) )
    – nobody
    Dec 31, 2020 at 10:08
  • 1
    "a second party getting Let’s Encrypt certificates on your domain" Isn't this only possible if they can also MitM the connection from Let's Encrypt to your server?
    – Michael
    Dec 31, 2020 at 14:22
22

The trust stores of major browsers (at least: Chrome, Firefox, Safari, Edge and Brave) at all cost avoid certificate authorities which could potentially be controlled by governments.

There once was an attempt by the government of Kazakhstan to add their official root certificate to the trust chains. It ultimately failed exactly due to the trust issues. Nowadays, chances even for a private company from a country with a heavy governmental influence on the economy (like Kazakhstan or Russia) to successfully commit their certificate to the public trust stores are basically nil.

Moreover, more than once Mozilla and other vendors explicitly banned (i.e. you cannot accept it on a page even if you want to) even the untrusted root certificate issued by Kazakhstan for MITM attacks. So even if, say, the potentially evil government of Valencia, Spain (for your information, their own root certificate is now present in your trust store — see) decides to eavesdrop on its users, such an attempt would cause the exclusion of their certificate from browsers, and pretty quickly.

Then it all comes down to risk modelling. Probably the governments would only risk the exclusion of their local certificate authorities if the stakes are high, e.g. they are chasing a notorious terrorist or a famous dissident. However, such people would probably use stronger privacy protection methods anyway.

7
  • 6
    Well, the question is, how do you find out about the MITM? You can't exclude a CA from the trust store if you don't even know they are MITMing certain users. And I'd also want to protect against MITMs by the US government since the Snowden revelations show they are willing to do it
    – nobody
    Dec 30, 2020 at 18:52
  • 1
    Things like that leak to the public pretty quickly, and even a suspicion may really result in the CA ban. CA/Browser forum is taking this really serious.
    – ximaera
    Dec 30, 2020 at 18:55
  • 1
    @ximaera: I saw in the news awhile back the LA police had an intermediate cert signed by the 1024 bit Verisign root that could sign anything. Couldn't get real traction to do anything about it back then. Now, I wouldn't be surprised though if it doomed a CA if it happened again.
    – Joshua
    Dec 31, 2020 at 5:10
  • 7
    @nobody You will notice that the US Government isn't on the list of trusted entities. They keep trying to get a limited root cert into the trust store (only valid for .gov, .mil, etc.), but the effort keeps stalling.
    – Michael
    Dec 31, 2020 at 14:58
  • 5
    @nobody There are, and they know their businesses will be destroyed if they comply. It's not a good position to be in. Dec 31, 2020 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.