The infrastructure upon which the Internet’s encryption system is built is fragile and prone to random, sometimes catastrophic, failures. The latest evidence of this weakness in the network is an incident involving a Chinese certificate authority WoSign, which was caught back-dating certificates and allowing customers to add arbitrary domains to their certificates.
The problems have been building up for some time, and officials at Mozilla have been investigating them for several months. Company officials said recently that Mozilla will distrust WoSign certificates going forward, as well as those issued by StartCom, a CA WoSign owns. What that means in practical terms is that Firefox users will see warnings about any of those certificates that the browser encounters online, telling them that the certificates are not trusted.
“Taking into account all the issues listed above, Mozilla’s CA team has lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA. Therefore we propose that, starting on a date to be determined in the near future, Mozilla products will no longer trust newly-issued certificates issued by either of these two CA brands,” Mozilla officials said in a document explaining the policy change.
The heart of the issue is that WoSign was issuing certificates that were backdated in order to allow customers to use certificates that use the deprecated SHA-1 hash algorithm. SHA-1 is considered insecure and browser vendors, including Mozilla, have directed its use, saying they will not trust certificates with SHA-1 signatures issued on or after Jan. 1, 2016.
Mozilla is not alone in moving against WoSign. Apple now says that it will remove trust in macOS for WoSign certificates going forward, too.
“Certificate Authority WoSign experienced multiple control failures in their certificate issuance processes for the WoSign CA Free SSL Certificate G2 intermediate CA. Although no WoSign root is in the list of Apple trusted roots, this intermediate CA used cross-signed certificate relationships with StartCom and Comodo to establish trust on Apple products. In light of these findings, we are taking action to protect users in an upcoming security update. Apple products will no longer trust the WoSign CA Free SSL Certificate G2 intermediate CA,” Apple said in a statement.
“To avoid disruption to existing WoSign certificate holders and to allow their transition to trusted roots, Apple products will trust individual existing certificates issued from this intermediate CA and published to public Certificate Transparency log servers by 2016-09-19. They will continue to be trusted until they expire, are revoked, or are untrusted at Apple’s discretion.”
There have been a number of other similar incidents with CAs in recent years that have caused browser vendors to remove trust for them, but most of those have been the result of the CA being compromised in some way. The WoSign episode is different in that it results from a perceived lack of control of the certificate-issuance process.
Image from Flickr stream of Marianna.
