There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference.

While there have been attempts by the NSA and others to "hack" or otherwise exploit root certicate authorities; is there anything preventing the NSA from becoming a Root CA itself?

It certainly has the resources and expertise, and could "suggest" to major OS vendors to add its Root CA to the default trust store list (which is large enough that it may not be noticed by anyone..?)

If it is feasible, what would the implications be? Could they essentially Man-in-the-Middle attack most HTTPS connections without a warning? (Perhaps not Dragnet-type interception, but close?) Or create a fake commercial root CA as obviously people would be suspicious if it had NSA plastered all over it?

  • 9
    In this context I like to cite once again (I did in a post on 23.9.2014) Ross J. Anderson who wrote in Sec.19.5.3 of his well-known book "Security Engineering", Wiley, 2001, the following: "In short, while public key infrastructures can be useful in some applications, they are unlikely to be the universal solution to security problems as their advocates seem to believe. They don't tackle most of the really important issues at all." Commented Oct 21, 2014 at 10:31
  • 5
    Note that the NSA has two tasks: ensure information security of the US (not just the government, also commerce and really the entire population) and gather information from outside the US. For task #1, it makes perfect sense for them to become a root CA for no nefarious reasons. Commented Oct 21, 2014 at 21:16
  • 3
  • 2
  • 1
    @Jörg W Mittag: For task #1 it makes perfect sense to become a CA, (or more likely stealing the keys of other CA's) for totally nefarious reasons - industrial espionage to serve US companies. Barring another Snowden (one that actually releases things that might be harmful to the US government), when secrecy is lifted in somewhere around 2100, I believe this is what we will find was happening.
    – JKAbrams
    Commented Nov 15, 2014 at 8:19

4 Answers 4


It is already done:

FPKI root in Windows' "trusted CA" store

It is the FPKI root CA, under explicit and full control of the US government. Windows already trusts it by default.

Before you flip out and begin to delete root CA certificates, burn your computer's motherboard, or drink a gallon of vodka, think about what it means. It means that the US government could technically emit a fake certificate for any SSL site that you are browsing -- but with a certificate chain that would point back to the US government. That is the point of having a "trusted CA" in the client: so that the client may validate a certificate chain. Therefore, such a forged site would hardly be a discreet way to eavesdrop on communications. All it would take would be a single user clicking on the padlock icon, reviewing the certificate chain, notice the FPKI root, and mock Obama on Twitter.

Pushing your own root CA in the "trusted store" of your victims is not an adequate way to spy on people without them noticing. Although it is a government agency, the NSA as a whole is usually not that stupid.

  • 56
    Whilst I agree overall with Thomas' statement about the indiscretion of this type of spying - it's still not without serious concerns. They could selectively serve a doctored certificate for specific IPs at specific times only. Few normal browsers log every cert chain they've encountered. Additionally, subversion of back-end HTTPS is even worse; such as between mobile apps and the cloud, or between enterprise SOAP and embedded systems. Almost every programming framework I know of trusts all Root CAs equally unless a rare security minded programmer strips out the defaults (explicit opt-out). Commented Oct 21, 2014 at 0:12
  • 53
    You don't even have any assurances that GoDaddy, or for that matter, any other CA, is not run by the NSA, except maybe asking nicely if they're actually run by the NSA, and if they say "yes", then it's true. They could easily start a company to work as a CA, and then, since it's a profitable venture, never report its expenses back to Congress.
    – Ernie
    Commented Oct 21, 2014 at 17:13
  • 7
  • 15
    @Thomas I think you cherry picked a blatantly obvious root CA. That one could easily be in there to access US government sites. What about the other ones that are covert, less obvious or have obscure names? I do not think this accounts for the scenario where NSA simply uses some of their $10.8B p.a. black budget to setup a shell corporation and purchase existing CAs like Verisign. Or just sends US based CAs a National Security Letter for a copy of the private key.
    – NDF1
    Commented Oct 22, 2014 at 20:35
  • 4
    Is this certificate only installed in US ? I don't have this root certificate on my Windows 8.1 computer in France.
    – Kedare
    Commented Nov 17, 2014 at 14:22

The NSA could and probably already has gone -- using a USA PATRIOT Act demand letter, or other similar legislative tool -- to all the major CAs in the United States (e.g. VeriSign, GeoTrust, etc.) and demanded that they remit their private root keys to "No Such Agency", "for purposes of 'national security'".

Of course, all such requests must (per PATRIOT Act law) be kept secret, and the CAs must lie to the public about their having complied with the request, or the chief executive officers of the CAs (and any of their underlings involved) are subject to long prison terms (with the trial, if any, conducted in camera in secret courts).

None of the above is unfounded speculation; it is based on well-known U.S. laws, which two successive U.S. administrations (Bush and Obama) have refused to change in any meaningful way, and in view of the Snowden revelations it would be extremely foolish to assume that this scenario hasn't already happened.

So yes -- the simple answer is, "the NSA doesn't need to do anything special to set up a root CA; because it can easily impersonate any of the existing (American) ones, at will".

  • 35
    This is pure speculation, with no citations. There are a lot of misconceptions out there about what the PATRIOT act actually says, and this looks like yet another instance of that. Speculation about legal matters from non-legal experts, without citations or evidence to back it up, is not very useful.
    – D.W.
    Commented Oct 21, 2014 at 18:44
  • 18
    Here is your citation @D.W. I disagree with your statement because what user53510 said is exactly what is likely happening.
    – NDF1
    Commented Oct 22, 2014 at 20:40
  • 11
    @D.W. from the citation, the part "the CAs must lie to the public about their having complied with the request" comes from "Patriot Act reauthorization statutes". I think that part is an important aspect. Commented Oct 23, 2014 at 4:30
  • 11
    @Joshua Isn't it exactly what happened to Lavabit? The ruling very clearly said that yes, destroying a business is of no concern. Commented Oct 24, 2014 at 11:54
  • 2
    I am not going down a slippery slope, the NSA is.
    – Joshua
    Commented Nov 4, 2014 at 18:38

No. In addition to the obvious government Root CAs in your trust stores; the NSA is a spy agency and as such has likely already stolen the private keys of several other CAs. If they are devious, they'd steal the private keys of other government CAs for potential false flag operations.

Additionally, unless every operating system and browser explicitly locks their updates to a specific CA or certificate only, they could use any Root CA they own or control to add a new anonymous CA (e.g. Issuer: Voldemort) to a trust store so that future back-tracing goes precisely nowhere.

  • 1
    That's an interesting one about hijacking update mechanisms to add imaginary CAs... and entirely possible :( Commented Oct 23, 2014 at 13:04
  • The updater in most OSes won't log which root CA added the new one?
    – ike
    Commented Oct 23, 2014 at 17:46
  • @ike Likely not; for if they did then they are recognising the problem, and would simply pin the updater to a specific root or leaf certificate in the first place. Commented Oct 23, 2014 at 21:56

They don't need to offer another certificate which points to them. They just need the private key of the server certificate to eavesdrop on the communication, which is probably easy to obtain if you have that kind of resources.

  • 1
    A single server key may be easier to obtain, but a CA would allow for a lot more than any single website or service to be eavesdropped on Commented Oct 20, 2014 at 20:54
  • 3
    yeah, but paying off one guy at each CA is probably easier to achieve than throwing MITM attacks with a legit root certificate and hoping nobody sees the difference. Unless of course they have already broken the ciphers, then it doesn't matter anyway.
    – user59089
    Commented Oct 20, 2014 at 21:00
  • It may be easier to pull off, but when someone discovers what happened, it's bad for business, intentional or not.
    – mpontillo
    Commented Oct 20, 2014 at 22:31
  • To decrypt a message you need the private key of the intended reader. Although it could be different for every conversation initiated (it can be discarded when the conversation is over), usually it isn't. Commented Oct 22, 2014 at 15:16
  • 2
    You haven't thought this through. How is it easier to obtain the millions (10s or 100s of millions?) of server certificates in use, and coordinate getting the right one to the right place on demand for use, when they could just get themselves control of even a single root CA and manufacture fake certificates to order?
    – mc0e
    Commented Oct 26, 2014 at 18:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .