Abstract:
Last week, the issue of the private key of the eMudhra certificate of the Indian Caotai Company attracted the attention of the entire industry. The eight intermediate CA certificates issued by the company all used weak keys. Among them, the private key of the EM OV TLS CA-G3C certificate was exaggerated to only the number 4, so anyone can directly use this certificate to issue sub-certificates for other domain names.
However, these problematic certificates have been revoked by browsers and operating systems. However, some devices may not check the certificate revocation list or be unable to obtain updates. The revoked certificate is still trusted, and the sub-certificate used for issuance can still be used.
So enthusiasts issued 106,000 certificates for Google domain names:
To test the use of eMudhra to issue certificates for any domain name, the first choice domain name is of course Google (just like domestic users open Baidu to check whether they are connected to the Internet), so the current CT certificate transparency log has recorded that enthusiasts have issued up to 106,000 certificates for Google's main domain name Google.com.
Currently, the certificate transparency log records 107,000 issuance records, 99% of which use Google domain names as test objects. These certificates can be authenticated by the CA public key, but because the intermediate certificate has been revoked by the browser, actual access will be blocked (unless the revocation record cannot be checked).
Why can certificates issued by myself be recorded by CT:
Because certificate issuance and CT log registration are different processes, under normal circumstances the CA uses the intermediate CA private key to issue the certificate after verifying domain name control. Someone with the leaked private key can create a certificate locally, write any domain name into the DNS name field, and then use the private key to sign.
RFC 9162 stipulates that anyone can submit a certificate to the CT log and attach the certificate chain for log inspection. The CT log is responsible for recording and publicizing the certificate for external review of the CA issuance status, and is not responsible for reviewing domain name control rights for the CA. Therefore, enthusiasts can be checked if they submit it to the CT log when issuing certificates.
Comments