4 ms·

Kazakhstan and probably Russia as well require all TLS traffic to be opened by MITM devices. https://m.habrahabr.ru/post/303736/ https://m.habrahabr.ru/post/303

Kazakhstan and probably Russia as well require all TLS traffic to be opened by MITM devices. https://m.habrahabr.ru/post/303736/ https://m.habrahabr.ru/post/303736/ https://news.ycombinator.com/item?id=10663843 https://news.ycombinator.com/item?id=10663843 https://www.google.co.il/amp/s/www.rbth.com/document/103300000000001000150127/amp https://www.google.co.il/amp/s/www.rbth.com/document/1033000... i wonder if other governments are enacting similar rules in one form or the other....

jopsen 9y ago
That sounds hard to implement. If it's done by issuing a new certificate for a different key then won't it trigger red flags when certificate transparency becomes mandatory? Resulting in the CA getting the kick.
- pfg 9y ago
  IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enforcement. Naturally, you can just not install the root certificate, but if all traffic is intercepted, I'd expect most users to do so to get around the warnings.
  - jopsen 9y ago
    That probably only works if the root cert is mandated in all OEM installs... And still you probably won't find any Linux distros with this support. Note. incepting all traffic sounds expensive and very dangerous, ie. risk or leaking grows when you scale. It's probably better to only use it for select users. Curious, why future versions of chrome would not force CT for official TLDs?
    - pfg 9y ago
      > Curious, why future versions of chrome would not force CT for official TLDs? This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they only accept certificates chaining back to a trusted root). Local roots were exempt from HPKP pins as well, so this is just keeping with existing policy.

jopsen 9y ago

That sounds hard to implement. If it's done by issuing a new certificate for a different key then won't it trigger red flags when certificate transparency becomes mandatory? Resulting in the CA getting the kick.

pfg 9y ago
IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enforcement. Naturally, you can just not install the root certificate, but if all traffic is intercepted, I'd expect most users to do so to get around the warnings.
- jopsen 9y ago
  That probably only works if the root cert is mandated in all OEM installs... And still you probably won't find any Linux distros with this support. Note. incepting all traffic sounds expensive and very dangerous, ie. risk or leaking grows when you scale. It's probably better to only use it for select users. Curious, why future versions of chrome would not force CT for official TLDs?
  - pfg 9y ago
    > Curious, why future versions of chrome would not force CT for official TLDs? This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they only accept certificates chaining back to a trusted root). Local roots were exempt from HPKP pins as well, so this is just keeping with existing policy.