4 ms·
Accessing the Information Assurance Website
- iamthepieman 10y agoThis seems perfectly appropriate. Who else is gonna sign their certs? We trust us, you should trust us and we don't trust anyone else.
- subway 10y agoThis is not a 'self-signed' certificate. This is an internal DISA Certificate Authority. Edit: Looking a bit closer, this is a web application that uses the CAC for client-certificate authentication. Odds are if you have a reason to be going to this site, you already have this CA cert installed, and are using your CAC to auth against it.
- aaronharnly 10y agoThat's true! I started with "asks you install a custom certificate authority" but the title got a bit long...
- mrmondo 10y agoIndeed, perhaps the title could be adjusted by a mod to make it less potentially misleading?
- devy 10y agoGenuine question: what's the big deal of using custom CA?
- jeremyjh 10y agoNothing, if you know your intended users will have that CA's root in their trust store, as the NSA likely does. A self-signed certificate is one generated on the hosting device itself - the actual webserver hosting the site - there is no chain of trust to a root certificate that could be in someone's trust store and consequently no way to know if there is a man-in-the-middle.
- dogma1138 10y agoSelf signing allows you to counter mitm just fine as you trust a specific certificate. A trust allows you to manage revocation easily and it doesn't requires you to trust 100's or 1000's of certificates independently.
- jlgaddis 10y agoThey aren't "self-signed", they're signed by the DoD certificate authorities (which probably requires more paperwork and due diligence than getting a certificate issued by GoDaddy, Comodo, etc.).
- nickpsecurity 10y agoIndeed: http://www.disa.mil/~/media/Files/DISA/Services/UCCO/APL-Process/UC_DoD_PKI_Guide.pdf http://www.disa.mil/~/media/Files/DISA/Services/UCCO/APL-Pro... For high-security (esp Type 1), they're also a system for generating and managing keys that the NSA controls: https://en.wikipedia.org/wiki/EKMS https://en.wikipedia.org/wiki/EKMS
- blakeyrat 10y agoWhy is this newsworthy? I'm no security expert.
- subway 10y agoIt isn't.
- wonkaWonka 10y agoIt's technical people of some notoriety being vaguely clever about high-brow qualifications, and at a certain level of humorousness, involves recursion.
- aaronharnly 10y agoThis practice cuts them off from the regular web. For example, suppose one wanted to link to their Guidelines for Securing Industrial Control Systems -- a client browser gets an error unless they've installed the DoD CA.
- jcrawfordor 10y agoGenerally, the DoD root CA is only used on websites that are not intended for public consumption. That said, as a civilian security professional, I have the DoD root CA imported on my workstations because I do run into sites signed by it from time to time, but usually in the course of looking up things specific to federal contracts.