4 ms·
Yes they have a cloud service: https://www.bluecoat.com/products-and-solutions/global-cloud-operations https://www.bluecoat.com/products-and-solutions/global-cl
by mrb 10y ago
Yes they have a cloud service: https://www.bluecoat.com/products-and-solutions/global-cloud-operations https://www.bluecoat.com/products-and-solutions/global-cloud...
In fact, other than running a legit CA service, using this intermediate CA to intercept and decrypt traffic on their cloud is the only acceptable use of the intermediate CA I can think of, as long as they disclose to their cloud customers that they MitM TLS connections. After all, Blue Coat's cloud is their network, so they have the right to operate it the way they want.
Any other use of the intermediate CA would be highly irresponsible/dangerous. For example if they used it in their SSL Visibility Appliance, any owner of the appliance could extract the CA private key from the appliance.
- 0x0 10y agoCouldn't they implement something like cloudflare keyless ssl to keep this (horrible) ca private key... private?
- mrb 10y agoThis would keep the key private, but would not contain the potential for abuse. The appliance owner could still invoke whatever mechanism is used to generate certs for arbitrary hostnames.
- mintplant 10y ago> In fact, other than running a legit CA service, using this intermediate CA to intercept and decrypt traffic on their cloud is the only acceptable use of the intermediate CA I can think of, as long as they disclose to their cloud customers that they MitM TLS connections. After all, Blue Coat's cloud is their network, so they have the right to operate it the way they want. Even that is silly - they don't need to be an intermediate CA to do that. Just require that their customers install a custom certificate.
- Buge 10y agoI'm unclear about what you're saying. Are you saying it is OK for them to MITM traffic to https://google.com https://google.com on their network by issuing a google.com cert? That is definitely not OK. If they only issue certs for domains that belong to themselves or their customers, that is OK.
- prdonahue 10y agoNotwithstanding key pinning (which I believe is even overridden by installed private roots), they can issue for google.com as long as they want so long as they get their users to install a private root.
- Laforet 10y agoThis, MITM using voluntarily installed trust anchors is one thing and explicitly allowed by google, creating a certificate for google.com that will be accepts by all TLS clients is not and Symantec have got in trouble before for doing this.
- prdonahue 10y agoCompletely agree. But there's virtually no way Symantec would turn them loose without confidence in their audit and controls around issuance processes, domain control validation, etc. I say "virtually" as if they do, Google will drop the hammer on them (again), this time a much heavier one. It's a business risk I just don't see them taking — they have too big of a revenue base to jeopardize it this way.
- JoshTriplett 10y agoIt's acceptable (albeit a terrible practice) to MITM traffic on your own network. It's not at all acceptable for any CA certificate accepted by default in all browsers (not just those on your network), no matter whether root or intermediate, to ever issue a certificate for a domain to anyone other than the owner of that domain. Issuing such a certificate is grounds for immediate revocation of browser trust. If you want to MITM traffic on your network, have clients install your MITM certificate, which gives them ample warning about what you're doing.
- TechnicalVault 10y agoIt may be acceptable in certain states and jurisdictions, but it is throughly illegal in others. Remember you aren't just MITMing your own network, if someone from your network connects to my server you are MITMing me too and you have not obtained my consent for that. Even if your state is a one party consent state, mine may not be or have laws that heavily restrict interception.
- jeremyjh 10y agoHe isn't talking about the legality of it at all. He is talking about what the browsers include in their trust store.
- tajen 10y agoMay Symantec's authority can be revoked completely, if proof of misuse is found?
- JoshTriplett 10y agoAssuming that Symantec doesn't manage to deflect onto Bluecoat, and assuming that browser vendors are willing to actually revoke one of the largest CAs for misuse rather than wagging their finger. The last time Symantec made a "mistake" with their CA (https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html https://security.googleblog.com/2015/10/sustaining-digital-c...), Google said "Therefore we are firstly going to require that as of June 1st, 2016, all certificates issued by Symantec itself will be required to support Certificate Transparency." Interesting wording, "by Symantec itself". And now, a few days before June 1st, Symantec issues an intermediate CA certificate to a known vendor of MITM systems, so that Bluecoat can issue certificates themselves rather than having their "certificates issued by Symantec itself". I wonder if Bluecoat will support Certificate Transparency?
- Canada 10y agoI don't see the legitimate use case here. If they're dealing with inbound TLS connections to their cloud services then they can scan or modify the traffic on the cleartext side of the TLS connection. No need to be a CA. If they have clients on their network they want to MITM then that's not a legitimate use case for a CA at all. It doesn't matter if everything is on their network, it's unacceptable that my browser accepts their signature.