2

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website is secured with an extended-validation certificate that is logged in the CT logs). In other words, if their main website is at https://example.com secured with an EV certificate, their login page is on the subdomain https://login.example.com secured with a DV certificate. The certificate that their login page is secured with does not show up on certificate transparency log lookup tools such has https://crt.sh/ and https://censys.io/certificates. It is my understanding that this is normal for Amazon-issued certificates, but I will transmit very sensitive information to the website so I want to be absolutely sure that I am on the right website.

What are the risks of trusting this certificate that cannot be found on CT logs? What can a malicious actor potentially do to impersonate the website's login page since the website has not implemented Certificate Transparency for that page? Is it possible to contact the bank to verify this certificate with them, and if so, is it necessary?

EDIT: The certificate showed up in the logs today (it was not there before). Not sure why it was took over a week but it is there now. The question still stands, however. What are the risks of trusting a certificate that has not been logged in CT logs, and what can a malicious actor do if I choose to blindly trust unlogged certificates?

4
  • 2
    Are you sure on what you see? Chrome requires CT on all certificates issued by publicly trusted CA since mid 2018 (i.e. it is mandatory and missing CT results in connection error) and ACM also supports this. See also aws.amazon.com/blogs/security/… . Can you provide the URL in question? Commented Mar 6, 2021 at 16:01
  • I just visited no-sct.badssl.com in Chrome and it loaded fine. Not sure if this is what you're asking about.
    – huanglx
    Commented Mar 7, 2021 at 14:14
  • 1
    "I just visited no-sct.badssl.com in Chrome and it loaded fine." - I get a clear NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED here, also with Chrome. Are you sure that you a) do not have CT checks disabled and b) really access the real certificate, i.e. that you are not behind some SSL intercepting proxy (many local antivirus do this too). Commented Mar 7, 2021 at 16:24
  • 1
    Turns out, antivirus was the culprit. I tried again on another computer (with no Web Protection or anything like that) and am now getting the error when visiting that site.
    – huanglx
    Commented Mar 7, 2021 at 21:17

0

You must log in to answer this question.