235

It is already done: It is the FPKI root CA, under explicit and full control of the US government. Windows already trusts it by default. Before you flip out and begin to delete root CA certificates, burn your computer's motherboard, or drink a gallon of vodka, think about what it means. It means that the US government could technically emit a fake ...


231

Serious certification authorities use heavy procedures. At the core, the CA key will be stored in a Hardware Security Module; but that's only part of the thing. The CA itself must be physically protected, which includes proactive and retrospective measures. Proactive measures are about preventing attacks from succeeding. For instance, the CA will be stored ...


138

This is more of a problem than you think, particularly for a company like Google, because they're a frequent target for this type of shenanigans. But there are several layers of safeguards, and our protection is getting better over time. Your first line of defense is the Certificate Authority. They shouldn't let certificates be signed inappropriately. Each ...


107

When a certificate is expired, its revocation status is no longer published. That is, the certificate might have been revoked long ago, but it will no longer be included in the CRL. Certificate expiration date is the cut-off date for CRL inclusion. That's the official reason why certificates expire: to keep CRL size bounded. (The unofficial reason is to ...


103

A custom CA is required if you want to use https on your corporate intranet. 3rd party CAs can only give you certificates for public domains. They won't give you certificates for intranet.local or any other hostnames which are only routed in your own network. So when you want to have a certificate for your intranet or for the web interface of your own ...


91

For the purposes of this discussion there are only a couple differences between web signing certificates: Extended vs standard validation (green bar). Number of bits in a certificate request (1024/2048/4096). Certificate chain. It is easier to set up certificates with a shorter trust chain but there are inexpensive certs out there with a direct or only ...


91

Why do big companies (...) not fully use CAs from countries with strict privacy laws like Switzerland or Sweden? Because any CA can issue a certificate for any domain anyway (with some caveats). If your ISP wanted to intercept all your future connections to https://example.com/ by exchanging its certificate with a rogue one, they wouldn't have to ask the ...


88

If your adversary is a powerful nation-state threat actor, web PKI will not protect you. Nothing is preventing them from issuing their own certificate. In fact, many governments run their own certificate authorities, such as the US FPKI and affiliates. See a list of CAs currently trusted by Firefox: Government of France Government of Hong Kong (SAR), ...


86

Let's Encrypt is a Certificate Authority, and they have more or less the same privileges and power of any other existing (and larger) certificate authority in the market. As of today, the main objective downside of using a Let's Encrypt certificate is compatibility. This is an issue that any new CA faces when approaching the market. In order for a ...


79

You are correct that SSL uses an asymmetric key pair. One public and one private key is generated which also known as public key infrastructure (PKI). The public key is what is distributed to the world, and is used to encrypt the data. Only the private key can actually decrypt the data though. Here is an example: Say we both go to walmart.com and buy ...


77

How does that work? They seem use an In-the-middle SSL Bump proxy. First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers. You have to install and accept the proxy's Certificate Authority cert to make this work. Once done, each SSL connection is made from your host to the SSL Bump Proxy with ...


75

How my browser can inherently trust a CA? Does in contain hard coded public key of the CA? Your browser (and possibly your OS) ships with a list of trusted CAs. These pre-installed certificates serve as trust anchors to derive all further trust from. When visiting an HTTPS website, your browser verifies that the trust chain presented by the server during ...


75

When the client is verifying a certificate, there are three possibilities: The certificate is signed by a CA that the client already trusts (and for which it knows the public key). In this case the client treats the certificate as valid. The certificate is signed by a CA about which the client has no knowledge at all. In this case the client treats the ...


73

A good question. The simplest answer is that having an expiration date ensures that you have an "audit" every so often. If there were no expiration date, and someone stopped using a certificate (and protecting the private key), no one would ever know. However, by having an expiration date you ensure that the user goes back to the company that sold them the ...


69

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


66

This "Kaspersky Anti-Virus Personal Root Certificate" is the sign that your anti-virus is actively intercepting the connection, in effect running a Man-in-the-Middle attack. This can work because your anti-virus runs locally (on your computer) its own certification authority, and inserted the corresponding CA key in the "trusted store" used by your browsers (...


66

Yup. Yes. (If you consider "My company's admins can change my HTTP(s) traffic" compromise.) Except for some programs that pin their certificate use and fail if another certificate is used. That's pretty much the idea of SSL inspection: Open up SSL/TLS, do some anti-virus-scanning, close up SSL/TLS again. And in place of that "do some anti-...


65

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed. Source: http://support.microsoft.com/kb/293781 Some certificates that are listed in ...


64

Let's start with the cynical view: Certificate Authorities are for-profit companies, so they will charge as much as they are able to get away with! More seriously, running a certificate authority is an expensive, low profit margin business, but the answer really comes down to the type of certificate you want. Domain-Validated (DV) Certificates For a ...


55

The NSA could and probably already has gone -- using a USA PATRIOT Act demand letter, or other similar legislative tool -- to all the major CAs in the United States (e.g. VeriSign, GeoTrust, etc.) and demanded that they remit their private root keys to "No Such Agency", "for purposes of 'national security'". Of course, all such requests must (per PATRIOT ...


53

You need to import the root certificate into the trust store for the browser. Once the browser knows you trust this root certificate, all certificates signed by this will show up as trusted. Note that this will only make the connection trusted for you, any others who don't have the root certificate installed will still receive an error.


52

As pointed out in comments and answers, there are plenty of legitimate reasons why you would want to add a CA to your browser's trust store, and the mechanisms for doing this require admin access to the machine / browser. You're implying a trust model where you don't consider your administrator (or past you) to be trustworthy and would like the browser to ...


51

At the byte level, X.509 is X.509 and there is no reason why the free SSL certificates would be any better or worse than the non-free -- the price is not written in the certificate. Any certificate provider can fumble the certificate generation, regardless of whether he gets paid for it or not. The hard part of a certificate is outside of it: it is in the ...


50

Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company to do this might also be somehow part of the contract or working rules which might also include that you are only allowed to use the company network for work ...


49

Thomas Pornin's answer is good, but a little outdated. Support for Name Constraints is growing. I've found that OpenSSL 1.0.1k and Windows 7 support the extension. Test Using XCA, I created a self-signed CA certificate, and added a critical Name Constraints extension for .lab.example.com, by adding the following line on the "Advanced" tab during ...


49

You are right assuming the certificate is useless without the private key, so sending it in the mail is no big security risk and is common practice actually. The certificate is supposed to be public, connecting to your website would also provide me with your certificate, so no need to hack your email there. edit When starting the connection the server ...


47

Facebook uses HSTS (with preload[*]) while steamcommunity.com doesn't. HTTP Strict Transport Security is a HTTP header that has two effects: It forces all connections to the site over HTTPS (even if it was accidentally linked/bookmarked/typed as HTTP) It aborts if any HTTPS error or warning exists. This includes self-signed certificate warnings, which ...


44

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


41

Being able to MitM a certificate authority is perhaps not as trivial as you imagine. You don't know what machine they're using to evaluate ownership, and hopefully they aren't doing this over Starbucks wifi. Certificates apply to domain names, not machines or IP addresses, and thus ownership is generally not verified by testing responses given by a certain ...


40

You can use it safely if you pin their certificate. This adds complexity to the maintenance and deployment but it does actually improve security. If you do not, then it depends on how they built their trust chain: if they are only using self-signed certificates, then you're out of luck and can't securely use their services. If they just use a private CA, ...


Only top voted, non community-wiki answers of a minimum length are eligible