Symantec issues more illegit HTTPS certificates

http://arstechnica.co.uk/security/2017/01/already-on-probation-symantec-issues-more-illegit-https-certificates/

by 0xbadf00d • 10 years ago

104 19 10 years ago

arstechnica.co.uk

aleksi• 10 years ago

In the same time, https://arstechnica.co.uk/ redirects to http://.

paralelogram• 10 years ago

How does issuing certificates for test1.com, test2.com, test3.com etc. "threaten the integrity of the encrypted Web"?

hannob3• 10 years ago

These domains belong to someone. Someone who likely hasn't agreed. It's deeply troubling when a CA says: "We'll just issue some test certs for domains that sound like we could use them for testing - no matter whom they belong to and if they agree to that." It's quite simple: Don't issue certs unless the owner of that domain has asked you for it.

But if you look closer at Andrew's mail: There were a bunch of other certs for all kinds of domains.

cube00• 10 years ago

Especially when we have TLDs for this purpose (.test and .invalid), it's just plain sloppy.

tialaramex2• 10 years ago

It's not about these particular certificates, it's about the fact that Symantec issued obviously bogus certificates at all, and then that they either didn't catch it or they caught it and decided to try not to tell us about it.

Even at best this is further evidence of incompetence, and incompetence certainly does threaten the integrity of the encrypted Web.

Ask yourself, if Symantec's "security" systems can issue for example.com without getting consent from the owner of example.com and Symantec don't notice, why not for your domain, or mine, or a big bank?

borplk• 10 years ago

How does it not threaten the integrity of the encrypted Web?

toyg• 10 years ago

Symantec was caught because they were already on the naughty list. I wonder how many other authorities around the globe are not caught simply because they are not scrutinized as much.

Sigh, this whole cert business is so broken, and still we don't have anything else to replace it with.

hannob3• 10 years ago

Symantec was caught because they were already on the naughty list. I wonder how many other authorities around the globe are not caught simply because they are not scrutinized as much.

Instead of wondering you could also help checking. All the data Andrew Ayer used is public.

azdle• 10 years ago

Except, most CAs aren't required to publish all certs to CT. Symantec is specifically required to because of hanky-panky in their past.

jwilk• 10 years ago

Duplicate of https://news.ycombinator.com/item?id=13447349

tetrep• 10 years ago

Symantec is investigating: https://groups.google.com/forum/#!topic/mozilla.dev.security...

I wonder what excuses we'll here this time, and if we'll lose a CA in the process.

poizan42• 10 years ago

The listed Symantec certificates were issued by one of our WebTrust audited partners. We have reduced this partner's privileges to restrict further issuance while we review this matter. We revoked all reported certificates which were still valid that had not previously been revoked within the 24 hour CA/B Forum guideline - these certificates each had "O=test". Our investigation is continuing.

So Symantec are letting third parties issue certificates using their root? Seems like a pretty bad idea when it's their own reputation that is on the line here. And also don't we have a system in place for that by using intermediary CAs that wouldn't require the certificates to be issued directly by Symantec?

paulddraper• 10 years ago

Yes, I don't get that. What justification is there for another party signing with your root?

Symantec issues more illegit HTTPS certificates

Related Stories