I would like to tighten up security a bit, so I am disabling unneeded certs from my browsers. For instance, the "WoSign CA Limited" cert from China I obviously don't need, yet "Thawte Consulting cc" I do.

Is there any way to see which certs I've actually used so that I could start making informed decisions? Take for example "Trustis Limited". On what basis would I decide to keep or leave it. Also, in addition to "Thawte Consulting cc" there is a cert for "thawte, Inc.". Might one be a spoof? How would I know?

  • 3
    This is a hard problem. You can’t really know which are legit, and you don’t even know which you need and will need in the future (service providers you rely on may change the CA they use, see Certificate Patrol to get an idea on the frequency of CA switches). One of the reasons why some people in the security community consider the CA system fundamentally broken. Most people normally have to rely on mozilla (or whoever composes your certificate store, may be google in your case) to make sensible tests on the certificates they recieve applications for. – Jonas Schäfer Oct 22 '14 at 15:20
  • 4
    In fact, Certificate Patrol would be exactly what you want (that, plus a few weeks of use). However, it is not available for google chrome. – Jonas Schäfer Oct 22 '14 at 15:22
  • @JonasWielicki, It's not so hard. We can selectively block by countries, then when there's a problem, we can then decide if we would wish to include it back into the list. Ban first, white-list later. – Pacerier May 25 '15 at 8:40
  • @Pacerier I don’t think that is easy. First, if you block the whole Five-Eyes-based CAs (which I would if I was to take this seriously), you’d immediately re-whitelist them. Nothing won there. Certificate Patrol has the neat advantage that it informs you about "suspicious" changes in the certificates (like, premature certificate changes or changes of the CA). – Jonas Schäfer May 27 '15 at 8:04

Episode #481 of the Security Now! podcast touches on the related subject of Certificate Transparency. The question "which CA's can I trust?" is replaced by "which certificates is known to represent a given site?".

Once RFC 6962 is universally deployed it allows us to detect that the "Hong Kong Post office CA" (aka the Chineese Government) has issued a fraudulent certificate to www.gmail.com which your pre-2015 browser would otherwise happily accept.

The concept that hundreds of CA's are trusted to issue certificates to any site is crazy.

  • 4
    Apparently Firefox has had a patch that would support RFC 6962 for a year now, but it has not been accepted into trunk. – dotancohen Nov 18 '14 at 7:27
  • 1
    Could you please explicitly quote an imaginary example as imaginary or provide citations? – phoeagon Mar 3 '15 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.