3

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers certificates, which are valid for thee years, I applied for their certificate, because I hoped to be able to skip the re-creation of new certificates in the next years.

During the process I wondered, why there was no indication from my browser, that it was creating a key pair, as I am used to from my last applications at different CAs. When the process was finished, a PFX file was offered for download. No need to export the certificate from the browser certificate storage.

According to their policy (in chapter 3.2.1), they offer to generate a private key for their subscribers. I understand, that this should be avoided, because nobody except the owner should ever be in possession of a private key. While they state, that subscribers may also choose to create own private keys and CSRs for server certificates, they don't make any statement about creating the private key for client certificate in another way.

Is my assumption correct, that the private keys used for their client certificates are really created on the server side, and is it correct, that (while they claim they don't) they could keep it and use it to decrypt/sign messages, exactly as the subscribers could do with their certificate? This should be totally unacceptable, because one would have to trust them, that they delete the private key, that they should not even had in the first place. But since I was unable to find any criticism about such an issue with their client certificate issuing process, I might have gotten something wrong.

  • 1
    I agree with your analysis; I would not use a CA who doesn't do the normal [user submits .csr] [CA returns .crt]. Especially if they "offer" to create my private key for me. – Mike Ounsworth May 9 '15 at 20:48
  • @MikeOunsworth I have never encountered a CA, that uses this procedure for S/MIME certificates. They always used the browser to generate the keys (likely using the keygen element) and I had to export the certificate from my browser's certificate storage. Still safe, because it was generated in MY browser. – Gurken Papst May 10 '15 at 10:44
  • Gurken You are correct that .csr is more used for x509 certs, my bad. The point still stands that the usual process is for user / user's browser to create the keypair, and submit some kind of file containing only the public key to the CA to be made into a certificate. Any CA that "offers" to generate your private key "for you is sketchy. – Mike Ounsworth May 10 '15 at 12:56
1

These certificates are of very little value. First of all, allowing them to generate the private key is very questionable. We have no details on how they do this or whether they retain this information - for all we know, they use the same private key for all certs or retain the key information, which may not be done in a secure manner (imagine what a rich target that datbase would be!).

the other problem with this service is that it has very weak vetting processes. The only real benefit of using a certificate service is to give your certificate an additional level of trust. If I receive an email or visit a site with a certificate, the degree to which I will trust that certificate is determined by the level of trust I have in the issuing authority. Certificates issue by this 'authority' have an extremely low level of trust because the issuer does not do any real vetting to ensure the certificate is being issued to the 'real' site or address owner.

Essentially, all this service is doing is making it easy for someone to get a certificate who doesn't want to learn how to create their own certificate using something like pgp. Of course, certificates you create yourself don't have much trust, but that is why you would normally grow that trust through key signing parties or using a recognised CA which does adequate vetting. Combine that with the fact you don't know who has access to the private key (assuming you allow the site to generate that data) and the certs provided by this service are possibly even less trustworthy than even a self signed certificate.

  • 2
    This does not really answer my question. I know that letting them generate my private key would be questionable, but I am unsure, if they actually do so. And why are you guessing (?) that all private keys would be the same or they would have to store them? Both would be even more stupid, fortunately it is not necessary. Your argument on the lack of vetting could be applied to any CA, that offers class 1 certificates. While I know of the benefits of a decentralized trust model, this question is about certificates in the X.509/PKI world. – Gurken Papst May 16 '15 at 12:40
  • If they can generate the certificate without you providing the private key, then they have to create it and therefore know it. Yes, guess re same/store, but look at the number of recent failures from companies who have shown exactly this level of stupidity. The point is, you don't know. The vetting was more about the site certs they offer, mentioned as I think it shows a general low trust level wrt the company as a CA. The only reason I can see for using a 3rd party to generate the cert (any class) is about trust. If trust doesn't matter, why bother - do it yourself and know who has the keys – Tim X May 16 '15 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.