Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was just wondering what will happen if the private key of a CA is leaked? Won't it be then possible to make fake certificates for any other website?

share|improve this question
1  
On March 2011, a Comodo affiliate registration authority was found to be compromised and several fake certificates issued. –  grawity Jul 14 '11 at 12:11
1  
Here's another instance: en.wikipedia.org/wiki/DigiNotar –  ta.speot.is Jan 29 '12 at 23:12
add comment

4 Answers

Question:

What will happen if the private key of a CA is leaked?

Meet answer:

make fake certificates for any other website

share|improve this answer
    
+1 for gentle humour. –  Wayne Johnston May 12 '10 at 14:18
add comment

Yes.

Verisign and other trusted root authorities keep their keys heavily protected because their entire business relies on having a trustworthy certificate.

If a leak were to happen, it wouldn't be long before Microsoft, Mozilla and the other vendors who keep lists of trusted CAs would remove the compromised certificate from their lists of trusted certificates, however the risk would still be there.

share|improve this answer
1  
eff.org/observatory I speak to this thread from it's future. About one month prior to this comment, Scheiner on security addressed this issue. They have unsurprisingly, not done the right thing. –  chiggsy Nov 4 '10 at 21:13
add comment

Actually, if you had a CA's private key, you could make real, but illegitimate, certificates. There would be nothing fake about them, except that they wouldn't be made by the CA.

Presumably those people who maintain lists of trusted CA certificates would remove the compromised key, and the CA would have to create a new key (trivial), make sure this one's more secure (definitely not trivial), and distribute new certificates. In the meantime, not everybody would get the new list without the old root cert but with the new root cert, and the certificate infrastructure would be even shakier than it is now.

share|improve this answer
add comment

If a private key for a CA was leaked they would likely revoke the key. This is assuming that you are talking about one of the keys that a CA uses. Normally a CA has a master key which signs several other keys which are used by trusted authorities that are authorized to sign CSR's for customers.

If a CA lost their root level private key used to sign then anyone using it could create a fake certificate and SSL would pretty much be useless until all browsers released an update with a new list of trusted CAs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.