4 ms·

> HP revoked its own signing certs rendering their existing signed code invalid. That it took them days to re-sign and published fixed binaries is HP’s fault no

by _qulr 6y ago

> HP revoked its own signing certs rendering their existing signed code invalid. That it took them days to re-sign and published fixed binaries is HP’s fault not Apple’s No, HP requested that Apple revoke the cert. Inexplicably, Apple complied with this unusual request. Apple later un-revoked the cert after Mac users started reporting problems.

aw1621107 6y ago
> Inexplicably, Apple complied with this unusual request. Kind of curious: how closely do CAs look at requests to revoke certificates? Is there a general pattern? Or does it vary by CA?
- deleted 6y ago
  [deleted]
- jlgaddis 6y ago
  > ... how closely do CAs look at requests to revoke certificates? If they want to remain a CA, very closely! -- Per the (Server Certificate) Baseline Requirements [0]: > 4.9.1.1 Reasons for Revoking a Subscriber Certificate > The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: > 1. The Subscriber requests in writing that the CA revoke the Certificate; > ... The Code Signing BR's [1] have almost the same requirement. For code signing certificates, the CA "MUST*" revoke the certificate upon request "within one business day" (cf. 13.1.5, IIRC). I'm not sure if this particular certificate falls under those BR's or not, though (see my other comment). My guess would be that it does not. -- [0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF) [1]: https://cabforum.org/wp-content/uploads/baseline_requirements_for_the_issuance_and_management_of_code_signing.v.2.0.pdf https://cabforum.org/wp-content/uploads/baseline_requirement... (PDF)
  - aw1621107 6y ago
    Thanks for explaining! Curious what the intent is behind Apple saying they'll evaluate the request. I do realize that this request falls under different guidelines, but I wonder whether it's merely a difference in wording rather than practice.
  - olliej 6y ago
    It is not closely examined. The "examination" for revocation is very simple for every CA - does the request include demonstrated control of the private key. If it does, honor the revocation request. They have at most one business day to revoke. For evidence of actual compromise (e.g. not a first party revocation request) they have 24 hours. Note that the the CARB rules don't allow the CA to delay revocation for compromised certs, even if the true owner asks for it.
- olliej 6y ago
  The only real requirement is proof that you possess the private key associated with the revocation. In fact anyone, without any proof of affiliation, just has to demonstrate they have possession of the private key to mandate 24 hour revocation.
jlgaddis 6y ago
> No, HP requested that Apple revoke the cert. Inexplicably, Apple complied with this unusual request. Inexplicable!? Not at all. Unusual? Nope. While I certainly can't claim to be familiar with Apple's code signing program (it's not relevant to me at all), pretty much any CA will revoke a certificate upon a request by the entity that possesses the private key. In fact, in the "Web PKI", a CA MUST do so (per the Baseline Requirements) -- within 24 hours! -- and, although I haven't read them, I suspect the "Code Signing" BR's have the same or a very similar requirement. Now, you might say "the Web PKI BR's don't apply here" and you'd be correct, obviously. I'm not even sure if the "Code Signing" BR's are relevant in this instance -- I don't know whether this is some private, Apple-only program or something broader. However, either way, I'll bet you a beer that the "rules" -- whichever are in effect -- explicitly state that the issuer will revoke a certificate upon request by the subject. By the way, this doesn't even consider the case where a private key becomes compromised. In those instances, you're pretty much always obligated to notify the issuer ASAP. That's besides the point, though, as that's not what happened here. (Note: The generally accepted way to request revocation is to send to the CA a "revocation request" signed with the private key.)
- _qulr 6y ago
  We don't need to speculate, the Certification Practice Statement is here: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... See section 4.8 in particular. "The Subscriber may initiate a revocation request by sending an email to product-security@apple.com. The request for revocation will then be evaluated by Apple."
  - jlgaddis 6y ago
    I was speculating because I'm not personally familiar with this specific program. If the issuing CA is subject to the CABF's Code Signing Baseline Requirements, then Apple "MUST" revoke the certificate "within one business day". My point, again, was that such a request is NOT "unusual" and an issuing CA complying with such a request is NOT "inexplicable". -- EDIT: Per the CABF's "Code Signing Certificate Working Group Charter" [0]: > Other functional models include those which allow developers to self-sign code and those in which the platform supplier manages the code signing or certificate issuance process, and these models are expressly excluded from the working group’s mandate. Common examples of these models that are expressly excluded from the scope of guidelines to be promulgated by the working group are Apple’s Developer ID program and Google’s Android. [0]: https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/ https://cabforum.org/2019/03/26/code-signing-certificate-wg-...
deleted 6y ago
[deleted]

by _qulr 6y ago

aw1621107 6y ago

> Inexplicably, Apple complied with this unusual request. Kind of curious: how closely do CAs look at requests to revoke certificates? Is there a general pattern? Or does it vary by CA?

deleted 6y ago
[deleted]
jlgaddis 6y ago
> ... how closely do CAs look at requests to revoke certificates? If they want to remain a CA, very closely! -- Per the (Server Certificate) Baseline Requirements [0]: > 4.9.1.1 Reasons for Revoking a Subscriber Certificate > The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs: > 1. The Subscriber requests in writing that the CA revoke the Certificate; > ... The Code Signing BR's [1] have almost the same requirement. For code signing certificates, the CA "MUST*" revoke the certificate upon request "within one business day" (cf. 13.1.5, IIRC). I'm not sure if this particular certificate falls under those BR's or not, though (see my other comment). My guess would be that it does not. -- [0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.3.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF) [1]: https://cabforum.org/wp-content/uploads/baseline_requirements_for_the_issuance_and_management_of_code_signing.v.2.0.pdf https://cabforum.org/wp-content/uploads/baseline_requirement... (PDF)
- aw1621107 6y ago
  Thanks for explaining! Curious what the intent is behind Apple saying they'll evaluate the request. I do realize that this request falls under different guidelines, but I wonder whether it's merely a difference in wording rather than practice.
- olliej 6y ago
  It is not closely examined. The "examination" for revocation is very simple for every CA - does the request include demonstrated control of the private key. If it does, honor the revocation request. They have at most one business day to revoke. For evidence of actual compromise (e.g. not a first party revocation request) they have 24 hours. Note that the the CARB rules don't allow the CA to delay revocation for compromised certs, even if the true owner asks for it.
olliej 6y ago
The only real requirement is proof that you possess the private key associated with the revocation. In fact anyone, without any proof of affiliation, just has to demonstrate they have possession of the private key to mandate 24 hour revocation.

jlgaddis 6y ago

> No, HP requested that Apple revoke the cert. Inexplicably, Apple complied with this unusual request. Inexplicable!? Not at all. Unusual? Nope. While I certainly can't claim to be familiar with Apple's code signing program (it's not relevant to me at all), pretty much any CA will revoke a certificate upon a request by the entity that possesses the private key. In fact, in the "Web PKI", a CA MUST do so (per the Baseline Requirements) -- within 24 hours! -- and, although I haven't read them, I suspect the "Code Signing" BR's have the same or a very similar requirement. Now, you might say "the Web PKI BR's don't apply here" and you'd be correct, obviously. I'm not even sure if the "Code Signing" BR's are relevant in this instance -- I don't know whether this is some private, Apple-only program or something broader. However, either way, I'll bet you a beer that the "rules" -- whichever are in effect -- explicitly state that the issuer will revoke a certificate upon request by the subject. By the way, this doesn't even consider the case where a private key becomes compromised. In those instances, you're pretty much always obligated to notify the issuer ASAP. That's besides the point, though, as that's not what happened here. (Note: The generally accepted way to request revocation is to send to the CA a "revocation request" signed with the private key.)

_qulr 6y ago
We don't need to speculate, the Certification Practice Statement is here: https://images.apple.com/certificateauthority/pdf/Apple_Developer_ID_CPS_v3.0.pdf https://images.apple.com/certificateauthority/pdf/Apple_Deve... See section 4.8 in particular. "The Subscriber may initiate a revocation request by sending an email to product-security@apple.com. The request for revocation will then be evaluated by Apple."
- jlgaddis 6y ago
  I was speculating because I'm not personally familiar with this specific program. If the issuing CA is subject to the CABF's Code Signing Baseline Requirements, then Apple "MUST" revoke the certificate "within one business day". My point, again, was that such a request is NOT "unusual" and an issuing CA complying with such a request is NOT "inexplicable". -- EDIT: Per the CABF's "Code Signing Certificate Working Group Charter" [0]: > Other functional models include those which allow developers to self-sign code and those in which the platform supplier manages the code signing or certificate issuance process, and these models are expressly excluded from the working group’s mandate. Common examples of these models that are expressly excluded from the scope of guidelines to be promulgated by the working group are Apple’s Developer ID program and Google’s Android. [0]: https://cabforum.org/2019/03/26/code-signing-certificate-wg-charter/ https://cabforum.org/2019/03/26/code-signing-certificate-wg-...

deleted 6y ago

[deleted]