3 ms·
However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?
by nneonneo 10y ago
However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?
- deleted 10y ago[deleted]
- excalibur 10y agoOfficial source is here. The "MilitaryCAC" download link is publicly accessible, and uses SSL: https://militarycac.com/dodcerts.htm https://militarycac.com/dodcerts.htm Alternatively, the DoD certs served up securely by Symantec: https://knowledge.symantec.com/support/eca-support/index?page=content&id=SO5198 https://knowledge.symantec.com/support/eca-support/index?pag...
- jcurbo 10y agoMilitaryCAC is not an official source, it's about using CACs on personally-owned computers.
- jcurbo 10y agoI haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons, as there are lots of things that download stuff automatically from DISA. I could be wrong though, and I agree that it should be served over HTTPS. The main DISA page is served over HTTPS: https://www.disa.mil https://www.disa.mil
- smileysteve 10y ago> there are lots of things that download stuff automatically from DISA So, programs are downloading certs automatically, where they would be even less likely to properly check checksums against a secure site. And create a additional small attack vector.
- fifteen_letters 10y ago> I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons Well, also because an HTTPS page would create a chicken-and-egg situation. How do you download the root certs if you can't see the page because you don't have the root certs? etc