4 ms·

Doesn't matter when you have CAs known to have backdated certificates to avoid the SHA-1 deadline and all they get is a temporary suspension with none of their

Doesn't matter when you have CAs known to have backdated certificates to avoid the SHA-1 deadline and all they get is a temporary suspension with none of their issued certs being revoked. The weak point of PKI is not the crypto, it's the CAs, of which there are too many and for whom there is little to no accountability.

geofft 10y ago
Revoking certs doesn't ascribe accountability to the CAs, it ascribes accountability to the end users. Which isn't a bad thing, per se - it's just not one we're set up for right now. (If, for instance, the CAs started spreading FUD about each other getting revoked and encouraged users to buy and configure two certs from two different CAs, they'd make more money and we'd be in a better place security-wise.) Preventing the CA from taking any new business ascribes accountability to the CA.
- snuxoll 10y ago
  Hrm, this just made me think. Is it possible to provide two different root chains for a X509 certificate? I'm guessing not, but if so depending on the business it might not be a bad idea (especially with HSTS, pin both intermediate roots so if one is revoked you could rely on trust to your secondary to continue service without hoping users hit your site after you updated your rules but before the root was revoked or distrusted).
  - geofft 10y ago
    You can't do this with a certificate (a certificate is a digital signature, and signing with two different CA keys gives you two different signatures). I suspect it's possible to do this with two different certificates for the same server key, presenting the backup leaf certificate as one of the certificates in the "chain" - SSL clients tend to just take the entire list of certificates and find an order for them, because server operators / implementations don't reliably send them in the right order. I don't know what clients deal with this well. Usually you'll have enough lead time to configure your servers to send the other certificate, though. All you need to do is buy it in advance and have it ready to deploy. And yeah, with HSTS you can definitely pin multiple intermediate roots.
    - snuxoll 10y ago
      I figured as much, my knowledge of X509 certs ends at knowing "generate a CSR, get it signed, install it" and operating a couple Dogtag CA's as part of FreeIPA. Having a secondary cert ready to be swapped out with an Ansible playbook (or whatever your tooling of choice is) and ensuring both intermediate roots are pinned seems to be the best way to handle this then. Good to know!
  - toast0 10y ago
    The TLS specs don't allow for that, each certificate (after the first) must have signed the previous certificate. Many client libraries are forgiving of chain issues, but not all, so it's going to get really nasty, really fast.
icebraining 10y ago
It wasn't just a suspension - they got kicked out and may only reapply after a year. Only if they pass strict scrutiny will they ever be re-admitted.
- snuxoll 10y ago
  Not to mention not being able to do business effectively for a year is basically a death sentence. "We sell certificates, but they won't work in Firefox, and maybe Chrome or IE if Google and Microsoft follow suit". Doesn't exactly sound like a vendor I'd purchase anything from.

geofft 10y ago

Revoking certs doesn't ascribe accountability to the CAs, it ascribes accountability to the end users. Which isn't a bad thing, per se - it's just not one we're set up for right now. (If, for instance, the CAs started spreading FUD about each other getting revoked and encouraged users to buy and configure two certs from two different CAs, they'd make more money and we'd be in a better place security-wise.) Preventing the CA from taking any new business ascribes accountability to the CA.

snuxoll 10y ago
Hrm, this just made me think. Is it possible to provide two different root chains for a X509 certificate? I'm guessing not, but if so depending on the business it might not be a bad idea (especially with HSTS, pin both intermediate roots so if one is revoked you could rely on trust to your secondary to continue service without hoping users hit your site after you updated your rules but before the root was revoked or distrusted).
- geofft 10y ago
  You can't do this with a certificate (a certificate is a digital signature, and signing with two different CA keys gives you two different signatures). I suspect it's possible to do this with two different certificates for the same server key, presenting the backup leaf certificate as one of the certificates in the "chain" - SSL clients tend to just take the entire list of certificates and find an order for them, because server operators / implementations don't reliably send them in the right order. I don't know what clients deal with this well. Usually you'll have enough lead time to configure your servers to send the other certificate, though. All you need to do is buy it in advance and have it ready to deploy. And yeah, with HSTS you can definitely pin multiple intermediate roots.
  - snuxoll 10y ago
    I figured as much, my knowledge of X509 certs ends at knowing "generate a CSR, get it signed, install it" and operating a couple Dogtag CA's as part of FreeIPA. Having a secondary cert ready to be swapped out with an Ansible playbook (or whatever your tooling of choice is) and ensuring both intermediate roots are pinned seems to be the best way to handle this then. Good to know!
- toast0 10y ago
  The TLS specs don't allow for that, each certificate (after the first) must have signed the previous certificate. Many client libraries are forgiving of chain issues, but not all, so it's going to get really nasty, really fast.

icebraining 10y ago

It wasn't just a suspension - they got kicked out and may only reapply after a year. Only if they pass strict scrutiny will they ever be re-admitted.

snuxoll 10y ago
Not to mention not being able to do business effectively for a year is basically a death sentence. "We sell certificates, but they won't work in Firefox, and maybe Chrome or IE if Google and Microsoft follow suit". Doesn't exactly sound like a vendor I'd purchase anything from.