5

Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company that isn't aware of this in time might find themselves without a trusted CA.

In case this happens, does TLS allow for a website to basically have a backup certificate in case the other one is revoked? Or does that lead to other security issues?

To be clear: I'm not talking about having multiple root CAs validate your website with the same cert to have more trust. I'm talking about having a backup certificate, already deployed to the website, that's automatically checked in case your default CA gets revoked, so your website always has trust.

  • I think you want multiple paths from leaf to root certificates. You can configure the server to send multiple intermediate certs for multiple paths and root CAs. – sebix Aug 29 '15 at 15:39
5

You can have a backup certificate from a different CA but you cannot serve multiple leaf certificates (i.e. certificates matching the hostname) within the same TLS connection. You can also not have multiple signatures (i.e. by different CA's) on the same certificate which is a similar question often asked in this context. But you could use different certificates for different connections so that not everything fails if a CA gets untrusted, even though this would be uncommon and several security extension might complain about the always changing certificate.

A company that isn't aware of this in time might find themselves without a trusted CA.

A CA gets not removed suddenly without a huge public outcry abut the compromise. And with the removals in the past it was often done in a way that certificates issued before the compromise where still valid for a while so that administrators had enough time to get a replacement certificate. Since there is no mechanism in the PKI structure which allows for this so you had special hacks in the browsers to support this.

If you are after all this public attention still not aware about the removal of the CA and did not get a replacement in time then you might have much worse problems in your IT security than a failing certificate.

1

TLS only allows a single cert.

You'd need to have some monitoring in place to check for this issue and automatically reconfigure your web server upon occurrence.

You can get the same CSR signed by multiple CAs. Each time you will get a separate cert signed by that single CA. You are likely better off with completely independent keypairs and CSRs for each of your backup certs to avoid confusion.

If someone manipulates the CRLs of a CA to revoke you site certificate (a leaf certificate) you are unlikely to be affected since CRLs are rarely checked in practice.

In contrast to leaf certs the root certs (aka trusted CA certs) are bundled with the operating system or software making TLS requests. The root certificates can only be revoked by endpoint reconfiguration or OS/software updates.

Beyond that, any trusted CA (regardless of competence) can sign all domain names. The process for verification used by many CAs isn't terribly robust and is weak to social engineering.

To mitigate the risk of CA social engineering you can use HPKP (pin cert to defend against replacement) to limit attacker opportunities: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning

  • 1
    There are no CRL's of the root CA. Root CA are trusted because their are built into the browser or system and can only be distrusted by removing them there, either by each user manually or by a system or browser update. – Steffen Ullrich Aug 29 '15 at 5:40
  • @SteffenUllrich good point. Thank you for clarifying that. The mitigation I was thinking of was of an attacker issuing CRL entries for your sites' certs. – Alain O'Dea Aug 29 '15 at 13:23
  • I think you need to clean up the part about CRLs. – Neil Smithline Aug 29 '15 at 17:22
  • @NeilSmithline I agree. Root certs and CRLs can easily be confused. I have edited my answer to address that. Does my edit correct the confusion? – Alain O'Dea Aug 29 '15 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.