4 ms·
Aren't CAs supposed to go through vetting and audits before getting trusted in operating systems and browsers? We even went through a SOC audit just for our own
by skullone 4y ago
Aren't CAs supposed to go through vetting and audits before getting trusted in operating systems and browsers? We even went through a SOC audit just for our own internal CA!
- perlgeek 4y agoWhile adding a new CA to trusted set requires some kind of rigor, there's a quite large selection of CAs that were just "always there". Since many browser vendors are reluctant to remove CAs (because it breaks lots of websites for users), they don't have too much leverage enforcing security practices.
- tgsovlerkhgsel 4y agoHere's the audit: https://bugzilla.mozilla.org/show_bug.cgi?id=1628720#c14 https://bugzilla.mozilla.org/show_bug.cgi?id=1628720#c14 The requirements they are supposed to check against: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.6.7.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... - section 5 addresses security, referencing "The CA/Browser Forum’s Network and Certificate System Security Requirements" - https://cabforum.org/network-security-requirements/ https://cabforum.org/network-security-requirements/, which at least in the version 1.3 that I saw required pentests and security scans.
- Avamander 4y agoI'd imagine CA/B forum adopting new rules to avoid situations like this. The very least just a requirement to publish security contact information.
- hulitu 4y agoAnd who is auditing them ? CIA ? Goldman Sachs ? KGB ? EFF ?