3 ms·

Is there a way to see if any CA has issued a cert for a site? If all CAs posted the certs they sign to some database, then there could be services that alert yo

by ikeboy 11y ago

Is there a way to see if any CA has issued a cert for a site? If all CAs posted the certs they sign to some database, then there could be services that alert you and you'd know right away and raise an alarm. If such a system doesn't exist, why not?

realityking 11y ago
Certificate Transparency (http://www.certificate-transparency.org http://www.certificate-transparency.org) is a Google initiative working on just that. It's already required for EV certs in Chrome.
- ikeboy 11y ago
  Have any CAs publically committed to submit all their generated certs to that? Does https://pki.google.com/ https://pki.google.com/ do that?
  - geofft 11y ago
    Chrome currently requires that all extended-validation certs with an issuance date of 1/1/2015 or later be submitted to the CT logs. (Otherwise it will not show up in the UI as an EV cert.) As with all browsers, only a subset of CAs are trusted to provide EV certs in the first place, regardless of whether they include the EV bits in the certificate. And this policy only applies to EV certs, not to all certs by an EV-capable CA.
    - Caer 11y ago
      With some exceptions, at least. For example, twitter.com shows up as an EV green bar while my browser tells me there's no CT information available. The CT website mentions a list of exceptions would be generated but I haven't been able to find any public list, and there's been no update to their rollout plans in over 7 months[1]. Oddly enough I noticed the other day that certificate-transparency.org isn't even accessible over https. [1] http://www.certificate-transparency.org/ev-ct-plan http://www.certificate-transparency.org/ev-ct-plan
      - geofft 11y ago
        The twitter.com cert I see in my browser was issued on 9 September 2014, which is before the 1 January 2015 threshold. (Eventually this should go away because a compromised CA key can obviously just lie about the time, but this is just a migration step.)
        Caer 11y ago
        You're right, I missed that at the top of the doc. I assumed all of the details would be in the numbered list.
geofft 11y ago
I think a good chunk of the foot-dragging on CT has been a concern about customers not wanting certs for private names to be publicized (yet wanting publicly-valid certs for those names). It's unclear if there are concrete customers with this actual concern, but the argument goes that if Uber gets a cert issued for lyft-acquisition.uber.com in advance of an announcement, they don't want that leaked in CT logs. The current Internet-Draft for RFC 6962bis allows them to register this in CT logs as "?.uber.com", which is enough for Uber's sysadmins to raise an alarm if something matching that pattern was issued without their knowledge. https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-08#section-3.2 https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-08#...

by ikeboy 11y ago

realityking 11y ago

Certificate Transparency (http://www.certificate-transparency.org http://www.certificate-transparency.org) is a Google initiative working on just that. It's already required for EV certs in Chrome.

ikeboy 11y ago
Have any CAs publically committed to submit all their generated certs to that? Does https://pki.google.com/ https://pki.google.com/ do that?
- geofft 11y ago
  Chrome currently requires that all extended-validation certs with an issuance date of 1/1/2015 or later be submitted to the CT logs. (Otherwise it will not show up in the UI as an EV cert.) As with all browsers, only a subset of CAs are trusted to provide EV certs in the first place, regardless of whether they include the EV bits in the certificate. And this policy only applies to EV certs, not to all certs by an EV-capable CA.
  - Caer 11y ago
    With some exceptions, at least. For example, twitter.com shows up as an EV green bar while my browser tells me there's no CT information available. The CT website mentions a list of exceptions would be generated but I haven't been able to find any public list, and there's been no update to their rollout plans in over 7 months[1]. Oddly enough I noticed the other day that certificate-transparency.org isn't even accessible over https. [1] http://www.certificate-transparency.org/ev-ct-plan http://www.certificate-transparency.org/ev-ct-plan
    - geofft 11y ago
      The twitter.com cert I see in my browser was issued on 9 September 2014, which is before the 1 January 2015 threshold. (Eventually this should go away because a compromised CA key can obviously just lie about the time, but this is just a migration step.)
      - Caer 11y ago
        You're right, I missed that at the top of the doc. I assumed all of the details would be in the numbered list.

geofft 11y ago

I think a good chunk of the foot-dragging on CT has been a concern about customers not wanting certs for private names to be publicized (yet wanting publicly-valid certs for those names). It's unclear if there are concrete customers with this actual concern, but the argument goes that if Uber gets a cert issued for lyft-acquisition.uber.com in advance of an announcement, they don't want that leaked in CT logs. The current Internet-Draft for RFC 6962bis allows them to register this in CT logs as "?.uber.com", which is enough for Uber's sysadmins to raise an alarm if something matching that pattern was issued without their knowledge. https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-08#section-3.2 https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-08#...