6 ms·

The exception process used by payment processors such as First Data were for SHA-1 certificates chaining to a root that was still publicly-trusted. They couldn

by agwa 10y ago

The exception process used by payment processors such as First Data were for SHA-1 certificates chaining to a root that was still publicly-trusted. They couldn't use an off-reservation root because their client devices didn't trust them. The roots that Symantec took off-reservation are regularly issuing SHA-1 certificates to anyone whose check clears. Got $1,699 to spare? https://www.thesslstore.com/symantec/secure-site-pro-sha1-private.aspx https://www.thesslstore.com/symantec/secure-site-pro-sha1-pr...

ethbro 10y ago
I may be being a bit dense, but if your client device contains a root that goes off-reservation, how does it ever receive a revocation notice? Doesn't everything that chains to that root via a valid chain still get trusted? Side note: Are payment systems required to link to revalidate their roots at any regular intervals?
- agwa 10y ago
  > I may be being a bit dense, but if your client device contains a root that goes off-reservation, how does it ever receive a revocation notice? Doesn't everything that chains to that root via a valid chain still get trusted? Yes, if a client isn't receiving root store updates it will continue to trust certificates chaining to the off-reservation root. This is why taking previously-trusted roots off-reservation is bad for the ecosystem and would ideally be prohibited. > Side note: Are payment systems required to link to revalidate their roots at any regular intervals? Many payment systems apparently have no automatic update mechanism, so I assume there is no requirement for such.
  - ethbro 10y ago
    Wow, the two of those combined with embedded systems with extended lifecycles seem like a recipe for disaster.
    - agwa 10y ago
      It really is :-(
iancarroll 10y ago
Indeed, I was just speculating that more banks and payment processors might take advantage of the off-reservation root if it was possible, given the type of companies that publicly showed they needed one.

by agwa 10y ago

ethbro 10y ago

I may be being a bit dense, but if your client device contains a root that goes off-reservation, how does it ever receive a revocation notice? Doesn't everything that chains to that root via a valid chain still get trusted? Side note: Are payment systems required to link to revalidate their roots at any regular intervals?

agwa 10y ago
> I may be being a bit dense, but if your client device contains a root that goes off-reservation, how does it ever receive a revocation notice? Doesn't everything that chains to that root via a valid chain still get trusted? Yes, if a client isn't receiving root store updates it will continue to trust certificates chaining to the off-reservation root. This is why taking previously-trusted roots off-reservation is bad for the ecosystem and would ideally be prohibited. > Side note: Are payment systems required to link to revalidate their roots at any regular intervals? Many payment systems apparently have no automatic update mechanism, so I assume there is no requirement for such.
- ethbro 10y ago
  Wow, the two of those combined with embedded systems with extended lifecycles seem like a recipe for disaster.
  - agwa 10y ago
    It really is :-(

iancarroll 10y ago

Indeed, I was just speculating that more banks and payment processors might take advantage of the off-reservation root if it was possible, given the type of companies that publicly showed they needed one.