5 ms·
The solution to this is Certificate Transparency[0], a distributed public log of certificate timestamps that are submitted by CA's and checked by browsers. CT
by nikcub 11y ago
The solution to this is Certificate Transparency[0], a distributed public log of certificate timestamps that are submitted by CA's and checked by browsers.
CT has been required for EV certificates in Chrome for a year now[1], and eventually will be required for all certificates otherwise they will error out on connection.
A certificate signed by a root cert that is not the original CA will not validate.
[0] https://www.certificate-transparency.org/ https://www.certificate-transparency.org/
[1] https://blog.digicert.com/certificate-transparency-required-ev-certificates-show-green-address-bar-chrome/ https://blog.digicert.com/certificate-transparency-required-...
- michaelt 11y agoUnfortunately, Chrome's current policy is to disable certificate transparency and HPKP when a certificate appears to have been manually installed, to support MITM proxies [1]. Needless to say, this makes HPKP and certificate transparency worthless when the client has been compromised by adware or viruses. [1] https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
- kuschku 11y agoAnd then you set a Group Policy to ban Chrome and instead enable a browser with more reasonable settings for this case, like Firefox.
- lmm 11y agoWhat are Firefox's settings for that case then, hmm? Does Firefox refuse to work with MITM proxies at all?
- magicalist 11y agoFirefox accepts local certs over pinned ones by default as well (superfish affected it too). I believe there is an about:config setting that can be changed to have it reject local certificates in the face of a pinned site, but if malware is putting certificates in Firefox's cert store, they can just as easily flip that setting as well.
- Dylan16807 11y agoHint: they do this because of group policy adding certificates
- yrro 11y agoWhy don't they change the green lock icon to a blue icon indicating a pair of eyes, that when clicked on explains that the connection is not secure because your IT department is monitoring the connection?
- lucaspiller 11y ago> Chrome's current policy is to disable certificate transparency and HPKP when a certificate appears to have been manually installed, to support MITM proxies Sidenote: Is there a way to disable these on iOS to inspect SSL traffic through a MITM proxy?
- AndyMcConachie 11y agoOr key-pinning RFC7469, Or DANE RFC6698. There are solutions, the point is they're not universally deployed.