4 ms·

Do you know how to find out which certificate issuers DON'T submit certs to transparency logs? Is there a list somewhere?

tialaramex 9y ago
Not logging certificates will eventually cause them not to be trusted in Chrome. The deadline was pushed back but it hasn't done away. Firefox doesn't have a firm intent to do the same but it's developing all the technology. So this is probably not a good idea. Even where a subscriber specifically didn't want their certs logged and the CA doesn't currently log everything if there's ever a problem it'll get logged. This is because both Google and Mozilla will ask to see all the affected certificates, and logging them is the easiest way to satisfy this requirement. If a CA seems to be trying to dodge this usually participants will take whatever form the CA did provide and upload it to the logs. Google's logs don't care who gives them a cert, they can independently determine that it's authentic so they'll log it.
- throwaway613834 9y ago
  Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.
  - jlgaddis 9y ago
    There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.
  - tialaramex 9y ago
    Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
  - gsich 9y ago
    Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.
    - throwaway613834 9y ago
      Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
      - gsich 9y ago
        Oh I forgot "internal hosts" in the comment. If you want external access you can still use your own CA. I think one can assume that an employee (with an employee device) has the CA installed. If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. This is not an unsolvable problem.
        throwaway613834 9y ago
        > If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. > This is not an unsolvable problem. You literally just did not solve it.
        gsich 9y ago
        Why not? If it's a public host, use a public CA. No need to hide it there. If it's an internal host, use your own CA. What is the problem?
regecks 9y ago
Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying. You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178 https://crt.sh/?id=49265178 I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) ! Kind of related, I also wrote https://ausdomainledger.net/ https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.
- throwaway613834 9y ago
  Ah, thanks! Yeah, currently I'm just waiting for LE's wildcard support, but then it hit me there might be others who don't even submit the 2nd-level domain to CT, which I'd prefer if possible.

tialaramex 9y ago

Not logging certificates will eventually cause them not to be trusted in Chrome. The deadline was pushed back but it hasn't done away. Firefox doesn't have a firm intent to do the same but it's developing all the technology. So this is probably not a good idea. Even where a subscriber specifically didn't want their certs logged and the CA doesn't currently log everything if there's ever a problem it'll get logged. This is because both Google and Mozilla will ask to see all the affected certificates, and logging them is the easiest way to satisfy this requirement. If a CA seems to be trying to dodge this usually participants will take whatever form the CA did provide and upload it to the logs. Google's logs don't care who gives them a cert, they can independently determine that it's authentic so they'll log it.

throwaway613834 9y ago
Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.
- jlgaddis 9y ago
  There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.
- tialaramex 9y ago
  Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
- gsich 9y ago
  Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.
  - throwaway613834 9y ago
    Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
    - gsich 9y ago
      Oh I forgot "internal hosts" in the comment. If you want external access you can still use your own CA. I think one can assume that an employee (with an employee device) has the CA installed. If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. This is not an unsolvable problem.
      - throwaway613834 9y ago
        > If this is a public host or you can't control the employee devices, then use a public cert, or live with the error message. > This is not an unsolvable problem. You literally just did not solve it.
        gsich 9y ago
        Why not? If it's a public host, use a public CA. No need to hide it there. If it's an internal host, use your own CA. What is the problem?

regecks 9y ago

Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying. You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178 https://crt.sh/?id=49265178 I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) ! Kind of related, I also wrote https://ausdomainledger.net/ https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.

throwaway613834 9y ago
Ah, thanks! Yeah, currently I'm just waiting for LE's wildcard support, but then it hit me there might be others who don't even submit the 2nd-level domain to CT, which I'd prefer if possible.