0

There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem to be a thing of the past though, and I haven’t found any recent information on certificate authorities issuing fake certificates either due to a cyber attack or deliberately, acting in bad faith.

But still, given the sheer scale of worldwide cyber espionage and authoritarian countries striving to make the surveillance of their Internet users absolute, I am wondering what prevents unscrupulous nation-state actors from simply bribing some certificate authorities to issue fraudulent (but cryptographically genuine) certificates for websites that they want to monitor in their territories.

From a helicopter view, it seems that the entire ecosystem of TLS certificates is based on a great deal of trust. We trust our browsers (e.g. Google Chrome or Mozilla Firefox) and operating systems (iOS, for instance) that they have done their homework and have only included reputable and trustworthy certificate authorities in their trusted lists. The browsers and operating systems, in turn, rely on external audits of these certificate authorities that confirm that the latter have proper safeguards in place. The results of the audits don’t seem to be publicly available, and to what extent those audits themselves rely on trust is unclear. The chain of trust may simply be a bit too long for it to be firm enough.

At the same time, the number of certificate authorities and their trusted certificates out there is not small. For instance, Apple’s list of trusted certificates contains more than 150 root certificates issued by around 70 certificate authorities from all around the world.

All that opens up plenty of space for potential misuse of trust.

How can I be sure that none of these certificate authorities or any of their trusted partners could be bribed by, let’s say, China, Russia, or Iran to provide them with fraudulent TLS certificates for popular websites that browsers would mistakenly treat as trusted, allowing those countries’ censorship agencies to conduct MITM attacks against their populations on a massive scale? Are there any control mechanisms that help prevent such misconduct or capture it after it has occurred?

2
  • " Are there any control mechanisms that help prevent such misconduct or capture it after it has occurred?" - You've added the tag "certificate-transparency", which is exactly about the mechanism which helps here. Did you add the tag w/o understanding what it stands for or do you think that it does not address the problem? Commented May 30, 2023 at 10:14
  • @SteffenUllrich, I looked over the questions asked under the “certificate-transparency” tag and they don’t seem to address my concern. If a corrupt certificate authority issues a fraudulent certificate, I assume it may upload it to the Certificate Transparency logs (such as crt.sh) just like if it were genuine. My question is (1) how to prevent a certificate authority from issuing a fraudulent certificate to begin with, and (2) once such a certificate is issued, how to quickly capture the fraud and revoke the certificate.
    – Gilgamesh
    Commented May 30, 2023 at 10:27

2 Answers 2

1

Technically, nothing prevents commercial CAs to issue fraudulent certificates. However, now all commercial CAs are required to publish any issued certificate into one or more public Certificate Transparency logs (brief explanation on DigiCert website). If CA fails to log the issued certificate in CT log, the certificate will be rejected by browser (here we are talking about TLS certificates only) as untrusted. Browsers automatically require that TLS certificate issued by a globally trusted CA is presented in CT logs.

And anyone can examine CT logs for potentially misissued certificates. This enables early CA breach detection and industry can take appropriate actions (distrusting breached CA) much faster.

Commercial CA distrust because of a breach may end the CA business, so CAs put much more efforts in requester validation to ensure that requester is eligible to enroll certificate for specified names.

0

There are several techniques which make it more difficult for malicious or compromised CAs to issue certificates for arbitrary websites:

  • Through Certificate Transparency (CT), a large number of issued certificates is publicly logged. Browsers like Chrome enforce the use of CT by only accepting certificates that are CT-compliant. This means there's a chance that mis-issued certificates will be detected at some point. Or, if a malicious CA doesn't log the certificate through CT, they won't be accepted in all browsers.
  • Through DNS Certification Authority Authorization (CAA), site owners can declare which CAs are authorized to issue certificates for their sites. If a CA checks these records, it can detect and prevent at least some cases where an attacker has compromised the CA and tries to issue certificates.
  • The now-obsolete HTTP Public Key Pinning allowed websites to enforce the use of specific public keys, so that certificates with a different public key could be detected and rejected.
  • Besides that, anybody can monitor the certificates that are used for different websites, so there' a chance that unusual certificates will be detected at some point.

If a CA is caught mis-issuing certificates, they risk getting kicked out major browsers, so there's an incentive to (1) protect themselves and (2) not abuse their power.

Of course none of this is perfect. The above techniques mostly address broad attacks where many different clients are affected. A targeted attack against specific clients is more difficult to detect and prevent.

2
  • Thank you for the explanation. My concern is a short-lived (and potentially, but not necessarily, targeted) attack where a corrupt certificate authority would mis-issue a certificate that would be (1) used only within a specific country (with the help of a MITM attack) and (2) only for a short period of time before it is noticed in a CT log.
    – Gilgamesh
    Commented May 30, 2023 at 10:52
  • Such an attack is possible for a short time, but when it is noticed in a CT log, then the corrupt CA has a major problem, because there's proof that they've issued an illegitimate certificate. The only explanations are that their security has been breached, or they are in fact corrupt. It's then the responsibility of the browser vendors to kick the CA out of the trust store. By the way, any browser user can do the same. If you consider a particular certificate not trustworthy, you're free to remove it
    – Ja1024
    Commented May 30, 2023 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .