3 ms·
This is how the public certificate authority system is set up. The client vendors (Google, Microsoft, Apple, Mozilla) choose what the rules are for trusting a C
by Titanous 11y ago
This is how the public certificate authority system is set up. The client vendors (Google, Microsoft, Apple, Mozilla) choose what the rules are for trusting a Certificate Authority and which ones meet the requirements. These "root programs" are the only thing that prevents rogue/incompetent CAs from mis-issuing certificates on a regular basis.
Since the CA business model is based on selling digital signatures that meet specific requirements, the threat of those certificates not working as advertised is compelling.
On the other hand, the client vendors can't go overboard with requirements on existing "too big too fail" CAs because the alternative is having large portions of the Internet stop working in their products due to untrusted certificates.
Edited to add: Google doesn't run its own root program, they use the OS root store, which will be from Apple, Microsoft, or Mozilla (most Linux distros use the Mozilla list). This means that the requirements from Google are in addition to those of the OS that is being used.
- andmarios 11y agoAFAIK Chrome comes with its own NSS certificate store and doesn't respect the system certificates. Firefox does the same.
- vtlynch 11y agoI believe Chrome uses the underlying system trust store but also has its own list that it uses where Google wants to be stricter/do its own thing.
- andmarios 11y agoHmm, searched a bit and it seems only on Linux Chrome doesn't respect the system certificates but relies on Mozilla's NSS store. Still, extremely annoying since NSS isn't where system certificates are stored on Linux.
- gsnedders 11y agoIt's too easy to get certs into the root store of most distros, which means they're not practically usable for secure communication. There's often no auditing of the CAs to ensure they are taking due care to minimise risk of a bogus certificate being issued. [1] To be fair, some things have improved: Debian (and maybe Ubuntu) now have the Mozilla trust store plus one additional root (SPI). That said, all you need is one bad actor for the system to fail, and it seems the only reason why SPI is there is Debian infrastructure relies on it—but that doesn't make SPI trustworthy. [2] [1]: https://plus.google.com/105761279104103278252/posts/eVdB6X3NpPg https://plus.google.com/105761279104103278252/posts/eVdB6X3N... [2]: http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git;a=blob;f=debian/README.Debian http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certific...