Apple's response to the WoSign incidents(groups.google.com) |
Apple's response to the WoSign incidents(groups.google.com) |
1. WoSign (who also owns StartCom) violated all sorts of industry standards. The worst of them was circumventing the SHA-1 deprecation by backdating an SSL certificate.
2. Now all the root programs (Mozilla, Apple, Microsoft, and Google) need to decide how they will react to this.
3. Mozilla proposed dis-trusting all new WoSign/StartCom certificates and giving them a chance to re-apply as a trusted CA in a year. This is only their proposed action, and they have not totally committed to it.
4. Apple has now said they will take similar action to Mozilla. Apple will block a specific intermediate certificate: "WoSign CA Free SSL Certificate G2"
But they will continue to "trust individual existing certificates" if they had been published to Certificate Transparency logs by September 19th.
While I have not personally confirmed this, my understanding is that there are other Wosign certificates that are trusted on Apple via cross-signing. So this seems like an incomplete solution - in the sense that some WoSign certificates (mainly the commercial certificates they sell, vs the ones they give away for free) will remain unaffected in anyway.
(Someone more familiar with the specifics of the Apple root store may be able to provide more clarity here)
5. Google and Microsoft have not yet committed to any action yet. Google will certainly make a detailed public announcement when they are ready.
6. Mozilla is meeting with QiHoo (a chinese tech company which owns a majority stake in WoSign). It is expected that Mozilla will make a final decision following this meeting.
Remember, this is a "security" company.
It's rather fascinating: https://webdesign.tutsplus.com/articles/qihoo-360-secure-the...
Personally, I wouldn't trust anything this "security" company is connected with anywhere need my devices, software, or business.
And thus why the CA system is broken in a nutshell.
This seems even more sensible than Mozilla's existing proposal to trust the certificate notBefore date until proof of further backdated certificates.
The question is how they'll actually do that. This was discussed in the moz-sec-policy-thread and people came to the rough conclusion that there are just too many wosign/startcom certificates to whitelist them in any reasonable way.
When this came up, the first thing I did was generate wildcard certs for our StartCom domains, as Mozilla is going to stop trusting things at some point.
But that was on ~26th September.
Choosing the 19th is giving existing customers of StartCom no chance to manage the problem in a sensible way. :(
When this came up, the first thing I did was generate wildcard certs for our StartCom domains
They might announce similar steps for StartCom in the future, but nothing as of yet.
what they've done is clear. it's been misconduct as a ca. untrust them. done. fuck you.
There are plenty of innocent sites who use WoSign/Startcom certificates.
It's easy to be flippant when you're not actually responsible for a browser which users use, and need to worry about adverse side-effects. You kill WoSign overnight and you now have millions of users habituated to ignoring TLS errors, and now know how to override internal browser security settings.
Hope it was worth it.
As it's widely reported that WoSign has taken over StartCom's infrastructure, this implies that StartCom StartSSL Free certificates going forward won't be trusted by Apple either, correct?
It also sounds a little strange to only call out the free certificates. Are they going to allow new paid OV/EV (and what they call 'IV') certificates to remain valid?
The WoSign existing-certs exemption probably involves a whitelist they're shipping along with the OS. A lot of the feasibility discussions on this approach have centered on the size of the required whitelist [1]. Taking the same approach with StartCom may not be possible due to the scale. Also, StartCom certificates don't have the same coverage in the Certificate Transparency logs - so the certificate dating is problematic.
Hmmm, thinking about this now, if I were Wosign, I would be having a fire sale on StartCom. Selling the brand immediately (maybe to an existing competent CA) and asking the trust store operators for understanding (probably conditioned on full CT reporting) might be a way to recoup some losses out of all this mess.
Representatives of Qihoo 360, StartCom, and Mozilla are meeting in London next week. I'm very curious what they will be discussing. [2]
[1] https://groups.google.com/d/msg/mozilla.dev.security.policy/... [2] https://groups.google.com/d/msg/mozilla.dev.security.policy/...
Let's Encrypt
AWS Certificate Manager
cPanel's AutoSSL
CloudFlare
Symantec Encryption Everywhere
Not to mention the certificates that can be bought very cheaply through resellers e.g. PositiveSSL.
mac OS will make this decision by first looking at signatures. It will receive the "end-entity" certificate (a cert for a specific site, like example.com) and while checking the chain, will see that there is a signature from the "WoSign CA Free SSL Certificate G2 intermediate CA" certificate.
It will then look at the "notBefore" date listed in the certificate, which tells you when the certificate was issued. If it is a new certificate, it will not be trusted.
If the certificate is preexisting (presumably issued before 9/19/16) it will be trusted ONLY if the certificate is CT logged. It will know if this is the case by looking for an SCT belonging to that certificate. The SCT will either be embedded directly in the certificate, or provided with the certificate during the SSL handshake (this is known as "stapling").
I doubt they'll do it this way. WoSign has only been embedding SCTs for all certificates since July and I wouldn't count on many webservers implementing SCT stapling. I expect Apple to ship a whitelist of hashes of certs that should be trusted instead.
You can check that log at https://crt.sh
"The supplier, Qua Tang Electronics, is blacklisted. Find every person associated, every member of the board, every senior officer, and blacklist any company they are associated with as well. With something like this, and the Chinese, there is no overkill. Be wildly unaimed in your fire. Nuke first, ask questions afterward. Make the pain as widespread as possible."
Hopefully if it expands to include StartCom certs, they use a later date.
I wouldn't call it broken. From what I see on Linux and Windows, Chrom[e|ium] relies on the system's trusted certificates. You always have the last says on who's in and who's out.
EDIT: Just checked, the Chromium-specific trusted CAs can be revoked through its configuration interface, doesn't just rely on system certs. Important detail, but still, user has the last word.
Bundling it into the browser would increase the download size by a substantial percentage, but 75MB as a 'security update' distributed through the App Store is comparatively tiny versus the 1GB+ which is typical for 10.11 to 10.11.1 style updates.
So, no "doubling down" involved. Just a desire to have actually working certs before Mozilla's "to be announced" cut off date happens.
And then Apple comes along and (unless I'm misunderstanding) all of our certs will be useless. :(
Continuing to use a CA that has a recognised history of fucking abysmal security and wilfully deceptive actions, whether you're paying money or not, is still "doubling down" IMO.
If you're getting a wildcard cert, you aren't getting EV, so why not just make the switch to LetsEncrypt?
We've already gone through the StartCom verification process, but had only generated a few specific cert's for subdomains.
However, we're right now in the process of launching a new online project. No idea what subdomains will be needed in very near future.
It costs us no extra to generate wildcard ones, which obviously is the right move to do as they'll be valid while StartCom's new ones are no longer trusted (when Mozilla stops accepting new certs).
There's literally no way we could afford to pay for new certs from an alternative registrar instead.
If ~$100 is that much for you (as a company of some sort) why don't you use Letsencrypt?
Lets Encrypt doesn't provide MS Authenticode signing certs (eg to validate our downloads are legit) though. Hopefully this whole mess doesn't scope creep to include those too.