3 ms·

Fascinating! What kind of effects can this have in real life? Are they going to have to revoke the affected certificates?

agwa 3y ago
They will indeed need to revoke the affected certificates within 5 days, per the Baseline Requirements. Also, the affected certificates won't be accepted by Certificate Transparency-enforcing browsers (Chrome and Safari) because of the precertificate mismatch.
- flangola7 3y ago
  Why does Firefox not enforce it?
  - agwa 3y ago
    Here's the 7-year-old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1281469 https://bugzilla.mozilla.org/show_bug.cgi?id=1281469 I don't know why it is taking them so long, but it makes me sad.
  - amiga386 3y ago
    Firefox, the browser, only cares if the certificate is valid (not expired, not revoked, ultimately signed by a root CA it trusts). It does not keep tabs on every certificate ever issued. You wouldn't like it if Firefox did an online check with a central authority for every website you visited, nor would you like it to bundle every single certificate ever issued (or even just serial numbers). Mozilla, the authors of the browser, are part of the CA/Browser Forum, which holds the threat of complete distrust in all web browsers against CAs, which compels CAs to be open and provide logs of all the certificates they've issued and prove they're not mis-issuing certificates. All those extra checks happen here.
    - agwa 3y ago
      > You wouldn't like it if Firefox did an online check with a central authority for every website you visited Enforcing Certificate Transparency does not require doing an online check for every website you visit. > Mozilla, the authors of the browser, are part of the CA/Browser Forum, which holds the threat of complete distrust in all web browsers against CAs, which compels CAs to be open and provide logs of all the certificates they've issued and prove they're not mis-issuing certificates. The CA/Browser Forum does not require CAs to log the certificates that they issue. CT is enforced entirely within the certificate validator code, and it is a major shortcoming that Firefox does not do it.
      - amiga386 3y ago
        You are correct: https://github.com/google/certificate-transparency/blob/master/docs/SCTValidation.md https://github.com/google/certificate-transparency/blob/mast... You can embed CT attestations (SCTs) in the certificate itself, so yes, provided the CA is in cooperation with CT log operators, and deliberately does the pre-certificate -> SCTs -> real certificate dance, it is possible for a browser to validate embedded SCTs without an online check. However, that assumes that the CA actively does that, they don't have to. Neither does the server. What's compelling them to is _policy_, set by Google and Apple, that their respective browsers won't accept certificates _without_ CT attestations. Google's policy specifically requires that one of the SCTs on a certificate must be a CT log run by Google. Google also controls the list of CT logs that Chrome will consider as valid CT logs, as part of deciding if an SCT is valid. Antitrust, anyone? I was trying to make a similar point about Firefox - policy vs code. And rather than saying that it's specifically the CA/Browser Forum setting policy (which it does, but only baseline policy, which does not include CT), each org in the CA/Browser Forum has their own root cert inclusion program with their own policies, that all draw from baseline policy then add to it. You are right, _baseline_ policy does not require CT.... ... and neither does _Mozilla's_ policy, now I've scanned through it. It actively acknowledges that CT exists (in that it mandates that if you issue a precertificate for CT, you _must_ issue the completed certificate), but it does _not_ require CAs to use CT. In stark contrast to Google and Apple. Perhaps this is why they also don't implement CT checking in Firefox?
        3y ago
    - marginalia_nu 3y ago
      > You wouldn't like it if Firefox did an online check with a central authority for every website you visited And yet OCSP stapling is still far from ubiquitous.
      - jraph 3y ago
        I wonder how much this has to do with OCSP stapling being so badly implemented in Apache 2 and nginx (don't know about the other servers). This article from 2009 [1] still seems current, at least I can attest that I still have issues with nginx. Also this super user Q&A [2] which suggest priming OCSP with a cron job because nginx does not do its job by itself. [1] https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/ https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-... [2] https://superuser.com/questions/1635407/ocsp-not-working-consistently-with-nginx/1658644#1658644 https://superuser.com/questions/1635407/ocsp-not-working-con...
    - johncolanduoni 3y ago
      Certificate Transparency verification only requires the server provide stapled proof (either to the certificate itself or a OCSP response) that the certificate was submitted to the public logs. It does not involve any extra requests from the browser to a third party; at most it involves a periodic request from the server to the CA with no client-specific data.
- mcpherrinm 3y ago
  Interestingly, Chrome does seem to be accepting the affected certificates based on some limited testing. I'm not sure why that would be, though. Chrome certainly requires SCTs to be present, but perhaps isn't (always?) checking the SCTs signatures over the certificates. Once we've wrapped this incident up, I'll have to follow up on that. Safari does seem to be rejecting them as expected.
  - agwa 3y ago
    I picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signatures, that's a serious bug that would enable bypass of CT enforcement, so I'm sure the Chrome team would want to hear more about what you've seen.
    - mcpherrinm 3y ago
      It turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updating). Chromium disables CT checking if it doesn't have an updated list of CT logs (either by component-updater or updating chrome itself). I see ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after updating.

agwa 3y ago

They will indeed need to revoke the affected certificates within 5 days, per the Baseline Requirements. Also, the affected certificates won't be accepted by Certificate Transparency-enforcing browsers (Chrome and Safari) because of the precertificate mismatch.

flangola7 3y ago
Why does Firefox not enforce it?
- agwa 3y ago
  Here's the 7-year-old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1281469 https://bugzilla.mozilla.org/show_bug.cgi?id=1281469 I don't know why it is taking them so long, but it makes me sad.
- amiga386 3y ago
  Firefox, the browser, only cares if the certificate is valid (not expired, not revoked, ultimately signed by a root CA it trusts). It does not keep tabs on every certificate ever issued. You wouldn't like it if Firefox did an online check with a central authority for every website you visited, nor would you like it to bundle every single certificate ever issued (or even just serial numbers). Mozilla, the authors of the browser, are part of the CA/Browser Forum, which holds the threat of complete distrust in all web browsers against CAs, which compels CAs to be open and provide logs of all the certificates they've issued and prove they're not mis-issuing certificates. All those extra checks happen here.
  - agwa 3y ago
    > You wouldn't like it if Firefox did an online check with a central authority for every website you visited Enforcing Certificate Transparency does not require doing an online check for every website you visit. > Mozilla, the authors of the browser, are part of the CA/Browser Forum, which holds the threat of complete distrust in all web browsers against CAs, which compels CAs to be open and provide logs of all the certificates they've issued and prove they're not mis-issuing certificates. The CA/Browser Forum does not require CAs to log the certificates that they issue. CT is enforced entirely within the certificate validator code, and it is a major shortcoming that Firefox does not do it.
    - amiga386 3y ago
      You are correct: https://github.com/google/certificate-transparency/blob/master/docs/SCTValidation.md https://github.com/google/certificate-transparency/blob/mast... You can embed CT attestations (SCTs) in the certificate itself, so yes, provided the CA is in cooperation with CT log operators, and deliberately does the pre-certificate -> SCTs -> real certificate dance, it is possible for a browser to validate embedded SCTs without an online check. However, that assumes that the CA actively does that, they don't have to. Neither does the server. What's compelling them to is _policy_, set by Google and Apple, that their respective browsers won't accept certificates _without_ CT attestations. Google's policy specifically requires that one of the SCTs on a certificate must be a CT log run by Google. Google also controls the list of CT logs that Chrome will consider as valid CT logs, as part of deciding if an SCT is valid. Antitrust, anyone? I was trying to make a similar point about Firefox - policy vs code. And rather than saying that it's specifically the CA/Browser Forum setting policy (which it does, but only baseline policy, which does not include CT), each org in the CA/Browser Forum has their own root cert inclusion program with their own policies, that all draw from baseline policy then add to it. You are right, _baseline_ policy does not require CT.... ... and neither does _Mozilla's_ policy, now I've scanned through it. It actively acknowledges that CT exists (in that it mandates that if you issue a precertificate for CT, you _must_ issue the completed certificate), but it does _not_ require CAs to use CT. In stark contrast to Google and Apple. Perhaps this is why they also don't implement CT checking in Firefox?
      - 3y ago
  - marginalia_nu 3y ago
    > You wouldn't like it if Firefox did an online check with a central authority for every website you visited And yet OCSP stapling is still far from ubiquitous.
    - jraph 3y ago
      I wonder how much this has to do with OCSP stapling being so badly implemented in Apache 2 and nginx (don't know about the other servers). This article from 2009 [1] still seems current, at least I can attest that I still have issues with nginx. Also this super user Q&A [2] which suggest priming OCSP with a cron job because nginx does not do its job by itself. [1] https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/ https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-... [2] https://superuser.com/questions/1635407/ocsp-not-working-consistently-with-nginx/1658644#1658644 https://superuser.com/questions/1635407/ocsp-not-working-con...
  - johncolanduoni 3y ago
    Certificate Transparency verification only requires the server provide stapled proof (either to the certificate itself or a OCSP response) that the certificate was submitted to the public logs. It does not involve any extra requests from the browser to a third party; at most it involves a periodic request from the server to the CA with no client-specific data.
mcpherrinm 3y ago
Interestingly, Chrome does seem to be accepting the affected certificates based on some limited testing. I'm not sure why that would be, though. Chrome certainly requires SCTs to be present, but perhaps isn't (always?) checking the SCTs signatures over the certificates. Once we've wrapped this incident up, I'll have to follow up on that. Safari does seem to be rejecting them as expected.
- agwa 3y ago
  I picked 10 affected sites at random, and Chrome correctly rejected every one with ERR_CERTIFICATE_TRANSPARENCY_REQUIRED. If Chrome isn't validating SCT signatures, that's a serious bug that would enable bypass of CT enforcement, so I'm sure the Chrome team would want to hear more about what you've seen.
  - mcpherrinm 3y ago
    It turns out my test was invalid: I had launched a VM to test, which turns out had an old Chromium installed (via the system package manager, so not self-updating). Chromium disables CT checking if it doesn't have an updated list of CT logs (either by component-updater or updating chrome itself). I see ERR_CERTIFICATE_TRANSPARENCY_REQUIRED after updating.