4 ms·

For those who are interested (probably not necessary on a Mac as they may be preinstalled), the DOD CA certs can be freely downloaded from DISA: http://iase.di

by Kadin 10y ago

For those who are interested (probably not necessary on a Mac as they may be preinstalled), the DOD CA certs can be freely downloaded from DISA: http://iase.disa.mil/pki-pke/Documents/unclass-installroot_v3-16-1a.zip http://iase.disa.mil/pki-pke/Documents/unclass-installroot_v... There are (impressively thorough, including recommendations on out-of-band fingerprint authentication) installation instructions included, and they provide PEM, PKCS7, and some weirdo Windows format.

nneonneo 10y ago
However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?
- deleted 10y ago
  [deleted]
- excalibur 10y ago
  Official source is here. The "MilitaryCAC" download link is publicly accessible, and uses SSL: https://militarycac.com/dodcerts.htm https://militarycac.com/dodcerts.htm Alternatively, the DoD certs served up securely by Symantec: https://knowledge.symantec.com/support/eca-support/index?page=content&id=SO5198 https://knowledge.symantec.com/support/eca-support/index?pag...
  - jcurbo 10y ago
    MilitaryCAC is not an official source, it's about using CACs on personally-owned computers.
- jcurbo 10y ago
  I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons, as there are lots of things that download stuff automatically from DISA. I could be wrong though, and I agree that it should be served over HTTPS. The main DISA page is served over HTTPS: https://www.disa.mil https://www.disa.mil
  - smileysteve 10y ago
    > there are lots of things that download stuff automatically from DISA So, programs are downloading certs automatically, where they would be even less likely to properly check checksums against a secure site. And create a additional small attack vector.
  - fifteen_letters 10y ago
    > I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons Well, also because an HTTPS page would create a chicken-and-egg situation. How do you download the root certs if you can't see the page because you don't have the root certs? etc

by Kadin 10y ago

nneonneo 10y ago

However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?

deleted 10y ago
[deleted]
excalibur 10y ago
Official source is here. The "MilitaryCAC" download link is publicly accessible, and uses SSL: https://militarycac.com/dodcerts.htm https://militarycac.com/dodcerts.htm Alternatively, the DoD certs served up securely by Symantec: https://knowledge.symantec.com/support/eca-support/index?page=content&id=SO5198 https://knowledge.symantec.com/support/eca-support/index?pag...
- jcurbo 10y ago
  MilitaryCAC is not an official source, it's about using CACs on personally-owned computers.
jcurbo 10y ago
I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons, as there are lots of things that download stuff automatically from DISA. I could be wrong though, and I agree that it should be served over HTTPS. The main DISA page is served over HTTPS: https://www.disa.mil https://www.disa.mil
- smileysteve 10y ago
  > there are lots of things that download stuff automatically from DISA So, programs are downloading certs automatically, where they would be even less likely to properly check checksums against a secure site. And create a additional small attack vector.
- fifteen_letters 10y ago
  > I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons Well, also because an HTTPS page would create a chicken-and-egg situation. How do you download the root certs if you can't see the page because you don't have the root certs? etc