7 ms·

Microsoft silently adds Amazon root certificates to its CTL

166 points by svenfaw 11y ago

z3t4 11y ago
Isn't SSL/TLS certificates broken when all you have to do is to add one root certificate to MITM everyone else's SSL/TSL?
- y0ghur7_xxx 11y ago
  Yes it is, and we all know it, but we are apparently unable to fix it.
- InclinedPlane 11y ago
  Is it broken when a CA can be compromised without consequence? Is it broken when bad actors can have root certs installed in most browsers? Yes, it's broken. It's been broken for a very long time.
  - rtpg 11y ago
    but all decentralised proposals I've ever seen fall over at scale, or become basically the CA system when applied at a big enough scale. I would like to be pointed out to be wrong here, though. the current CA system bugs me for the "one CA compromised" aspect.
    - arpa 11y ago
      What about DANE? I would imagine it has potential to do away with CA...
      - icebraining 11y ago
        https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
        arpa 11y ago
        Well that definitely answers my question. Thank you. What about something like certificate blockchain? e.g. https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
        hannob 11y ago
        It already exists and is called Certificate Transparency: https://www.certificate-transparency.org/ https://www.certificate-transparency.org/
        arpa 11y ago
        holy sh*t it's learning day today! Thanks!
  - deleted 11y ago
    [deleted]
  - cm2187 11y ago
    In a way it's broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can't allow to fail, otherwise we break the internet. I wonder if we shouldn't adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let's encrypt for commercial certificates.
    - realusername 11y ago
      A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.
    - icebraining 11y ago
      I think that's one of the goals of Let's Encrypt, by developing the ACME protocol, which will be submitted as a standard RFC: https://ietf-wg-acme.github.io/acme/ https://ietf-wg-acme.github.io/acme/
- Buge 11y ago
  Well there's public key pinning which helps.
  - exo762 11y ago
    Which is by itself broken. Large websites exchange certificates very often, rendering pinning useless. Unless you are talking not about pinning but about pinning by external actor, such as Google. And that is just moving your own security from hands of CA to hands of Google.
    - icebraining 11y ago
      You can pin a certificate higher in the chain, like the root cert of your CA. That way, you can still rotate your own cert, but an attacker couldn't just install a new root cert in the machine, they would have to get a cert from the same CA as your own.
      - viraptor 11y ago
        Do any of the publicly available CAs provide a guarantee that you can pin them? I remember there was at least one case of someone pinning a CA and making the news because the page could not load anymore.
        icebraining 11y ago
        I can't say I know, but I don't think they can simply replace them at will, otherwise wouldn't existing certs just stop working?
        viraptor 11y ago
        The intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.
- ben0x539 11y ago
  Isn't adding new root certificates basically the same attack vector as just turning off or routing around your SSL? Who can mess with your certificate store who can't also just run whatever code on your machine?
- sebcat 11y ago
  Dan Kaminsky had a good talk[1] regarding this on 26c3, where he essentially argued that the only reason we have TLS at all is because companies selling stuff over the Internet wants to make it seem secure for the customer. State actors or large companies interested in data mining are not that interested in committing credit card fraud, so every one just accepts the PKI status quo more or less. Or that was what I took away from what he said. I havn't seen the complete talk since he held it. [1] https://events.ccc.de/congress/2009/Fahrplan/events/3658.en.html https://events.ccc.de/congress/2009/Fahrplan/events/3658.en....
  - marshray 11y ago
    That may have been true with the original SSL, but consider all the B2B APIs, VPNs, and other critical stuff happening over TLS these days.
    - sebcat 11y ago
      The problem is the PKI. For your own services, you can have your own PKI, and the issue of "trust one, trust all" is not really an issue anymore because you would only trust your own certificates for your own services. The problem is that pretty much any CA trusted by your OS/browser can issue certificates that allows anyone who can control your network to MITM you. A solution for this would be DNSSEC, where only .com would be able to sign foo.com, bar.com and other .com domains. But still, would you trust the issuer of .com certificates?
- zeveb 11y ago
  Yup. What's really, really sad (and an indictment of our entire industry) is that RFCs 2692[1] & 2693[2] provided a mechanism to address exactly this point, but were completely ignored despite being correct. XPKI attempted to bind a server private key and some sort of global identity, but that only really makes sense with some sort of global identity root. Not wanting to trust all identities to a single CA, we instead … trust all identities to all CAs, which seems a strictly worse situation. And it turns out that we don't particularly want to bind servers to public identities most of the time, anyway: essentially no-one ever opens a certificate to see what it actually certifies. Amazon is amazon.com; Google is google.com; what people care about is if the server they are visiting is indeed the one they care about visiting — which means that all they really want is a binding of a server to a DNS name. The way this should work is that (ultimately) the IETF should issue a certificate to each domain holder, valid for the lifetime of that domain's registration. The domain holder would then be able to issue certificates to any subdomain of the domain he holds (e.g. the U.S. government could issue a certificate to va.us, which could then turn around and issue a certificate to fairfax.va.us). The CA business is a racket. XPKI is fundamentally broken, and no-one cares. We've had a solution for twenty years, and no-one has deployed it. [1] https://tools.ietf.org/html/rfc2692 https://tools.ietf.org/html/rfc2692 [2] https://www.ietf.org/rfc/rfc2693.txt https://www.ietf.org/rfc/rfc2693.txt P.s.: Funny how a Google search can return such different URLs for the same RFCs…
rockdoe 11y ago
IIRC Chrome uses or at least used to use the Windows certificate store. So will it trust these automatically?
- akerro 11y ago
  Yes, Firefox ships it's own package of trusted roots.
xupybd 11y ago
"Amazon is reported to have some very close ties to spy agencies." Why would we trust that any of the other providers would not co-operate with the CIA? Wouldn't they have to under the law?
- rmc 11y ago
  Do you wonder why the European Data Protection Agencies are getting ready to block all EU-US data transfer soon?
  - akerro 11y ago
    and create their own "security" certificates?
    - evook 11y ago
      That's probably still better then tolerating economic espionage. But since this very dreaming, I personally still hope for the new Audit of CAcert end of this month. The CAcert root certificate would be a reason for me to use letsencrypt only as a fallback for HPKP.
      - e12e 11y ago
        Didn't realize they were still moving forward with that (despite using CAcerts myself). Thanks for the heads up. I suppose that's as good an excuse as any to hold off a bit on moving to letsencrypt (To be clear, with CAcert not being in any of the default cert-stores, I wouldn't recommend avoiding letsencrypt in favour of CAcert to the casual user -- but I don't (currently) need a widely trusted anchor for what I use CAcert for. Even if it would've been nice if it was widely trusted out of the box).
    - JupiterMoon 11y ago
      Why the scare quotes? Some EU countries have a better record than the US on bulk surveillance of their own citizens. It is perfectly natural that if the US won't respect their citizens basic human rights then those countries will have to place restrictions on the US. EDIT Not to say that all EU countries have a better record. The UK performs bulk surveillance on a huge scale.
moviuro 11y ago
See the info repo provided by amazon: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/
FiloSottile 11y ago
All Amazon roots are cross-signed by other trusted roots, so they were already trusted by all systems, including Microsoft: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/ They are also on their way to be added natively to the Firefox root store: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401
- svenfaw 11y ago
  Indeed they are cross-signed with a Starfield root, so I wonder, what would be the point of adding them natively? Are there any benefits to that?
  - FiloSottile 11y ago
    Eventually, once the roots are trusted natively in enough systems, dropping the cross-signed root, making handshakes smaller and path-building simpler. Also some of their roots are stronger than the cross-signer, so when/if the cross-signer becomes too weak and gets dropped, the better Amazon roots will stay. And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.
    - vtlynch 11y ago
      >And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability. Just to clarify on your last point. If Amazon wants to issue certificates it has to conform to industry regulations and undergo audits regardless of if its using another companies' roots.
- mtgx 11y ago
  Is it cross-signed by the CIA, too, though? (one of Amazon's largest customers) Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it? This isn't the first time it has done this. It makes matters worse in light of all the "silent" upgrades they are doing to Windows 10, many of them about bypassing tools that are stopping its invasive privacy "features".
dredmorbius 11y ago
CTL???
- rusanu 11y ago
  Certificate Trust List [1]. > A CTL is a predefined list of items signed by a trusted entity. ... The primary use of CTLs is to verify signed Messages, using the CTL as a source of trusted root certificates. [1] https://msdn.microsoft.com/en-us/library/windows/desktop/aa376545(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
  - dredmorbius 11y ago
    Thanks.
rusanu 11y ago
AWS just announced Amazon Certificate Manager service, free SSL/TLS certs for assets hosted on AWS[1]. It makes sense to ask trust roots to add Amazon own certs. [1] https://aws.amazon.com/blogs/aws/new-aws-certificate-manager-deploy-ssltls-based-apps-on-aws/ https://aws.amazon.com/blogs/aws/new-aws-certificate-manager...
- rusanu 11y ago
  BTW if you request a ACM cert for <domain>, make sure you set up one of the admin@, administrator@, hostmaster@, postmaster@, webmaster@ email addresses for <domain>, as the ACM verification email is sent to these addresses, in addition to the WHOIS registered for <domain>. The ACM certs cannot be used with an EC2 hosted site.
  - ceejayoz 11y ago
    > The ACM certs cannot be used with an EC2 hosted site. For clarity, ACM's certs don't come with access to the private key, so you can't install them yourself directly on an EC2 instance. You can easily and fairly cheaply put an ELB or CloudFront in front of that EC2, though.
  - acdha 11y ago
    To be even more pedantic, it's the hostname not the domain. If you request www.example.com you need to have a working MX for www.example.com if you don't have access to the email for the domain's technical contact.
nailer 11y ago
If there's an issue here, it's not that the root stores adding Amazon's root certs are doing anything nefarious: it's simply that Microsoft should improve their communication.
- crosre 11y ago
  Could it be they were not provided that option?
xutopia 11y ago
Can someone explain this like I'm 5? I'm not sure what this means and why it matters.
- josinalvo 11y ago
  (maybe I got a bit carried away with 'like I am 5' :P) 1. When you type an address in the address bar, (say, www.mybank.com) it is possible for the network infrastructure to take you to mybank.com, but also possible for it to take you to evilsite.com 2. To prevent this, browsers check that mybank.com has a secret number[0]. If not, they tell you the infrastructure is messing with you. 3. To know the correct secret number to mybank.com, you "consult" some other "sites"[1] 4. But how can you tell if those sites are OK? Checking some other site? At some point, you need numbers that your browser knows since installation 5. Amazon just got one of their numbers into the 'internet explorer' browser 6. The author of the article is afraid amazon uses their numbers to 'vouch' for evilsite.com rather than mybank.com (every number in your browser can vouch for any number for any site -- which is kind of dumb) 6a. Also, author notes that, while adding numbers to a browser is usually a big deal, microsoft has not told anyone that they are adding amazon's number [0] technically correct, but a bit misleading [1] technically wrong, but hey, you are 5
vpcguy 11y ago
Microsoft published their updated list of CAs on their website today, and Amazon is there. http://social.technet.microsoft.com/wiki/contents/articles/31634.microsoft-trusted-root-certificate-program-participants-v-2016-jan.aspx http://social.technet.microsoft.com/wiki/contents/articles/3...

166 points by svenfaw 11y ago

z3t4 11y ago

Isn't SSL/TLS certificates broken when all you have to do is to add one root certificate to MITM everyone else's SSL/TSL?

y0ghur7_xxx 11y ago
Yes it is, and we all know it, but we are apparently unable to fix it.
InclinedPlane 11y ago
Is it broken when a CA can be compromised without consequence? Is it broken when bad actors can have root certs installed in most browsers? Yes, it's broken. It's been broken for a very long time.
- rtpg 11y ago
  but all decentralised proposals I've ever seen fall over at scale, or become basically the CA system when applied at a big enough scale. I would like to be pointed out to be wrong here, though. the current CA system bugs me for the "one CA compromised" aspect.
  - arpa 11y ago
    What about DANE? I would imagine it has potential to do away with CA...
    - icebraining 11y ago
      https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
      - arpa 11y ago
        Well that definitely answers my question. Thank you. What about something like certificate blockchain? e.g. https://github.com/okTurtles/dnschain https://github.com/okTurtles/dnschain
        hannob 11y ago
        It already exists and is called Certificate Transparency: https://www.certificate-transparency.org/ https://www.certificate-transparency.org/
        arpa 11y ago
        holy sh*t it's learning day today! Thanks!
- deleted 11y ago
  [deleted]
- cm2187 11y ago
  In a way it's broken for the same reason than the banking system was: too big to fail. So many websites rely on a few CA that we can't allow to fail, otherwise we break the internet. I wonder if we shouldn't adopt a solution similar to what was adopted for banks: a plan for orderly failure. Having a protocole, at least for DV certificates, to easily switch all your website to another CA. All CA would have to implement the same API, and all web servers would be able to consume that API. The same API would be used for auto-renewing certificates. Effectively generalising let's encrypt for commercial certificates.
  - realusername 11y ago
    A protocol should definitely be in place for that, all the updates I do are handled just by using apt-get except for certificates. Like I don't want to handle myself anything related to certificates (including the list of ciphers, the generation of new certificates, the compromised CAs ...), the current certificate system feels like the equivalent of installing updates with .tar.gz archives.
  - icebraining 11y ago
    I think that's one of the goals of Let's Encrypt, by developing the ACME protocol, which will be submitted as a standard RFC: https://ietf-wg-acme.github.io/acme/ https://ietf-wg-acme.github.io/acme/
Buge 11y ago
Well there's public key pinning which helps.
- exo762 11y ago
  Which is by itself broken. Large websites exchange certificates very often, rendering pinning useless. Unless you are talking not about pinning but about pinning by external actor, such as Google. And that is just moving your own security from hands of CA to hands of Google.
  - icebraining 11y ago
    You can pin a certificate higher in the chain, like the root cert of your CA. That way, you can still rotate your own cert, but an attacker couldn't just install a new root cert in the machine, they would have to get a cert from the same CA as your own.
    - viraptor 11y ago
      Do any of the publicly available CAs provide a guarantee that you can pin them? I remember there was at least one case of someone pinning a CA and making the news because the page could not load anymore.
      - icebraining 11y ago
        I can't say I know, but I don't think they can simply replace them at will, otherwise wouldn't existing certs just stop working?
        viraptor 11y ago
        The intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.
ben0x539 11y ago
Isn't adding new root certificates basically the same attack vector as just turning off or routing around your SSL? Who can mess with your certificate store who can't also just run whatever code on your machine?
sebcat 11y ago
Dan Kaminsky had a good talk[1] regarding this on 26c3, where he essentially argued that the only reason we have TLS at all is because companies selling stuff over the Internet wants to make it seem secure for the customer. State actors or large companies interested in data mining are not that interested in committing credit card fraud, so every one just accepts the PKI status quo more or less. Or that was what I took away from what he said. I havn't seen the complete talk since he held it. [1] https://events.ccc.de/congress/2009/Fahrplan/events/3658.en.html https://events.ccc.de/congress/2009/Fahrplan/events/3658.en....
- marshray 11y ago
  That may have been true with the original SSL, but consider all the B2B APIs, VPNs, and other critical stuff happening over TLS these days.
  - sebcat 11y ago
    The problem is the PKI. For your own services, you can have your own PKI, and the issue of "trust one, trust all" is not really an issue anymore because you would only trust your own certificates for your own services. The problem is that pretty much any CA trusted by your OS/browser can issue certificates that allows anyone who can control your network to MITM you. A solution for this would be DNSSEC, where only .com would be able to sign foo.com, bar.com and other .com domains. But still, would you trust the issuer of .com certificates?
zeveb 11y ago
Yup. What's really, really sad (and an indictment of our entire industry) is that RFCs 2692[1] & 2693[2] provided a mechanism to address exactly this point, but were completely ignored despite being correct. XPKI attempted to bind a server private key and some sort of global identity, but that only really makes sense with some sort of global identity root. Not wanting to trust all identities to a single CA, we instead … trust all identities to all CAs, which seems a strictly worse situation. And it turns out that we don't particularly want to bind servers to public identities most of the time, anyway: essentially no-one ever opens a certificate to see what it actually certifies. Amazon is amazon.com; Google is google.com; what people care about is if the server they are visiting is indeed the one they care about visiting — which means that all they really want is a binding of a server to a DNS name. The way this should work is that (ultimately) the IETF should issue a certificate to each domain holder, valid for the lifetime of that domain's registration. The domain holder would then be able to issue certificates to any subdomain of the domain he holds (e.g. the U.S. government could issue a certificate to va.us, which could then turn around and issue a certificate to fairfax.va.us). The CA business is a racket. XPKI is fundamentally broken, and no-one cares. We've had a solution for twenty years, and no-one has deployed it. [1] https://tools.ietf.org/html/rfc2692 https://tools.ietf.org/html/rfc2692 [2] https://www.ietf.org/rfc/rfc2693.txt https://www.ietf.org/rfc/rfc2693.txt P.s.: Funny how a Google search can return such different URLs for the same RFCs…

rockdoe 11y ago

IIRC Chrome uses or at least used to use the Windows certificate store. So will it trust these automatically?

akerro 11y ago
Yes, Firefox ships it's own package of trusted roots.

xupybd 11y ago

"Amazon is reported to have some very close ties to spy agencies." Why would we trust that any of the other providers would not co-operate with the CIA? Wouldn't they have to under the law?

rmc 11y ago
Do you wonder why the European Data Protection Agencies are getting ready to block all EU-US data transfer soon?
- akerro 11y ago
  and create their own "security" certificates?
  - evook 11y ago
    That's probably still better then tolerating economic espionage. But since this very dreaming, I personally still hope for the new Audit of CAcert end of this month. The CAcert root certificate would be a reason for me to use letsencrypt only as a fallback for HPKP.
    - e12e 11y ago
      Didn't realize they were still moving forward with that (despite using CAcerts myself). Thanks for the heads up. I suppose that's as good an excuse as any to hold off a bit on moving to letsencrypt (To be clear, with CAcert not being in any of the default cert-stores, I wouldn't recommend avoiding letsencrypt in favour of CAcert to the casual user -- but I don't (currently) need a widely trusted anchor for what I use CAcert for. Even if it would've been nice if it was widely trusted out of the box).
  - JupiterMoon 11y ago
    Why the scare quotes? Some EU countries have a better record than the US on bulk surveillance of their own citizens. It is perfectly natural that if the US won't respect their citizens basic human rights then those countries will have to place restrictions on the US. EDIT Not to say that all EU countries have a better record. The UK performs bulk surveillance on a huge scale.

moviuro 11y ago

See the info repo provided by amazon: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/

FiloSottile 11y ago

All Amazon roots are cross-signed by other trusted roots, so they were already trusted by all systems, including Microsoft: https://www.amazontrust.com/repository/ https://www.amazontrust.com/repository/ They are also on their way to be added natively to the Firefox root store: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401

svenfaw 11y ago
Indeed they are cross-signed with a Starfield root, so I wonder, what would be the point of adding them natively? Are there any benefits to that?
- FiloSottile 11y ago
  Eventually, once the roots are trusted natively in enough systems, dropping the cross-signed root, making handshakes smaller and path-building simpler. Also some of their roots are stronger than the cross-signer, so when/if the cross-signer becomes too weak and gets dropped, the better Amazon roots will stay. And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability.
  - vtlynch 11y ago
    >And I guess being a first class citizen of the CA space, which is good because it brings audits, participation and accountability. Just to clarify on your last point. If Amazon wants to issue certificates it has to conform to industry regulations and undergo audits regardless of if its using another companies' roots.
mtgx 11y ago
Is it cross-signed by the CIA, too, though? (one of Amazon's largest customers) Also, what is it with Microsoft that it keeps "silently" adding root certs to its operating system or other services? Does it really not understand that's highly suspicious? Why not publicly announce it? This isn't the first time it has done this. It makes matters worse in light of all the "silent" upgrades they are doing to Windows 10, many of them about bypassing tools that are stopping its invasive privacy "features".

dredmorbius 11y ago

CTL???

rusanu 11y ago
Certificate Trust List [1]. > A CTL is a predefined list of items signed by a trusted entity. ... The primary use of CTLs is to verify signed Messages, using the CTL as a source of trusted root certificates. [1] https://msdn.microsoft.com/en-us/library/windows/desktop/aa376545(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...
- dredmorbius 11y ago
  Thanks.

rusanu 11y ago

AWS just announced Amazon Certificate Manager service, free SSL/TLS certs for assets hosted on AWS[1]. It makes sense to ask trust roots to add Amazon own certs. [1] https://aws.amazon.com/blogs/aws/new-aws-certificate-manager-deploy-ssltls-based-apps-on-aws/ https://aws.amazon.com/blogs/aws/new-aws-certificate-manager...

rusanu 11y ago
BTW if you request a ACM cert for <domain>, make sure you set up one of the admin@, administrator@, hostmaster@, postmaster@, webmaster@ email addresses for <domain>, as the ACM verification email is sent to these addresses, in addition to the WHOIS registered for <domain>. The ACM certs cannot be used with an EC2 hosted site.
- ceejayoz 11y ago
  > The ACM certs cannot be used with an EC2 hosted site. For clarity, ACM's certs don't come with access to the private key, so you can't install them yourself directly on an EC2 instance. You can easily and fairly cheaply put an ELB or CloudFront in front of that EC2, though.
- acdha 11y ago
  To be even more pedantic, it's the hostname not the domain. If you request www.example.com you need to have a working MX for www.example.com if you don't have access to the email for the domain's technical contact.

nailer 11y ago

If there's an issue here, it's not that the root stores adding Amazon's root certs are doing anything nefarious: it's simply that Microsoft should improve their communication.

crosre 11y ago
Could it be they were not provided that option?

xutopia 11y ago

Can someone explain this like I'm 5? I'm not sure what this means and why it matters.

josinalvo 11y ago
(maybe I got a bit carried away with 'like I am 5' :P) 1. When you type an address in the address bar, (say, www.mybank.com) it is possible for the network infrastructure to take you to mybank.com, but also possible for it to take you to evilsite.com 2. To prevent this, browsers check that mybank.com has a secret number[0]. If not, they tell you the infrastructure is messing with you. 3. To know the correct secret number to mybank.com, you "consult" some other "sites"[1] 4. But how can you tell if those sites are OK? Checking some other site? At some point, you need numbers that your browser knows since installation 5. Amazon just got one of their numbers into the 'internet explorer' browser 6. The author of the article is afraid amazon uses their numbers to 'vouch' for evilsite.com rather than mybank.com (every number in your browser can vouch for any number for any site -- which is kind of dumb) 6a. Also, author notes that, while adding numbers to a browser is usually a big deal, microsoft has not told anyone that they are adding amazon's number [0] technically correct, but a bit misleading [1] technically wrong, but hey, you are 5

vpcguy 11y ago

Microsoft published their updated list of CAs on their website today, and Amazon is there. http://social.technet.microsoft.com/wiki/contents/articles/31634.microsoft-trusted-root-certificate-program-participants-v-2016-jan.aspx http://social.technet.microsoft.com/wiki/contents/articles/3...