3 ms·

What does this mean: "...nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network,..." If the certificate

by ArchD 12y ago

What does this mean: "...nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network,..." If the certificates were used only in a test (private?) network, how did Google find out?

MichaelGG 12y ago
I believe Chrome will report back when it finds an improperly issued certificate.
- ryan-c 12y ago
  https://scotthelme.co.uk/hpkp-http-public-key-pinning/ https://scotthelme.co.uk/hpkp-http-public-key-pinning/ Chrome also preloads HPKP information for many sites. It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue.
  - pooper 12y ago
    > It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue. I believe this is how Microsoft Family Safety works, as far as I know.
    - bashinator 12y ago
      This is how all corporate SSL inspection works.
  - geofft 12y ago
    They weren't even trying to do that, is the saddest part. They were trying to be a real CA, but they weren't trying to MITM. (It's common practice for new / young CAs to chain their CA cert off a more established CA.) They just, for some reason, decided that they wanted to store their cert on a Palo Alto Networks device that supported MITMing as a feature, and accidentally turned on MITM mode and plugged someone's laptop into it. The intended use case of that feature on that device is in fact to hand it a private intermediate, not a publicly-trusted intermediate.
    - 0x0 12y ago
      "accidentally". Playing loose and fast with a CA key and installing it on random devices like this speaks volumes about their understanding and respect of the world wide CA system.
- deleted 12y ago
  [deleted]

by ArchD 12y ago

MichaelGG 12y ago

I believe Chrome will report back when it finds an improperly issued certificate.

ryan-c 12y ago
https://scotthelme.co.uk/hpkp-http-public-key-pinning/ https://scotthelme.co.uk/hpkp-http-public-key-pinning/ Chrome also preloads HPKP information for many sites. It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue.
- pooper 12y ago
  > It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue. I believe this is how Microsoft Family Safety works, as far as I know.
  - bashinator 12y ago
    This is how all corporate SSL inspection works.
- geofft 12y ago
  They weren't even trying to do that, is the saddest part. They were trying to be a real CA, but they weren't trying to MITM. (It's common practice for new / young CAs to chain their CA cert off a more established CA.) They just, for some reason, decided that they wanted to store their cert on a Palo Alto Networks device that supported MITMing as a feature, and accidentally turned on MITM mode and plugged someone's laptop into it. The intended use case of that feature on that device is in fact to hand it a private intermediate, not a publicly-trusted intermediate.
  - 0x0 12y ago
    "accidentally". Playing loose and fast with a CA key and installing it on random devices like this speaks volumes about their understanding and respect of the world wide CA system.
deleted 12y ago
[deleted]