3 ms·
Didn’t some certificate authorities get caught issueing wildcard certificates for anything to government? I remember Google noticing that because the did manual
by tinus_hn 6y ago
Didn’t some certificate authorities get caught issueing wildcard certificates for anything to government? I remember Google noticing that because the did manual certificate pinning in their apps.
- tialaramex 6y agoI suspect you're thinking of DigiNotar in 2011, a Dutch outfit which was successfully attacked, perhaps by people working for or on behalf of Iran. The attackers appear to have had effectively full control and issued certificates for *.google.com among other things. DigiNotar - including some related functions for the Dutch government - was distrusted by everybody as a result. But it's also possible you're thinking of TÜRKTRUST, which mistakenly issued Intermediate CA certificates to subscribers asking for leaf certificates, resulting in creation of a google.com certificate issued from one of these bogus intermediates. TurkTrust is no longer trusted by Mozilla but I believe it is still trusted in Windows just locked by the "notBefore" policy to restrict the date range of certificates covered. Or NICCA in India, which I believe was only ever trusted by Windows, and had some problems the full details of which aren't public but included attacks on Google. Or possibly CNNIC, which we know effectively authorised a third party to mint fraudulent certificates as part of some sort of misguided "security" feature and so was distrusted. But probably it's DigiNotar you were thinking of, that's the closest match to your description although "to government" sort of implies this was specifically done on instruction of the Iranian government and I don't think that was ever proven.