Maybe I’m mistaken but aren’t the logs cryptography verifiable? (As in you can’t create a rouge cert without it creating a trace)
Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?
WhyJiffie@sh.itjust.works 2 weeks agowhich is still there if you are not using lets encrypt, because they can strongarm them to make a fake cert for your domain, and install a proxy repackaging HTTPS traffic with the fake certificate. all browsers trust the lets encrypt root certificate, so they won’t see anything suspicious.
the only thing there today to detect this (but not avoid) is certificate transparency logs. all modern certificates are required to be added to this log, for the CA to remain compliant. but browsers are not checking the logs, that would be a lot of additional traffic and how do they decide if a certificate was created maliciously? also, lets encrypt could afford being noncompliant, browser vendors can’t realistically just distrust their root certificate, many sites would become inaccessible.
possiblylinux127@lemmy.zip 2 weeks ago
WhyJiffie@sh.itjust.works 2 weeks ago
apparently certs can have a cryptographic proof of having been included in the CT logs. but what do browsers do if the letsencrypt cert has no such proof?
needanke@feddit.org 2 weeks ago
You can test that on this site:
IpsumLauren@lemmy.world 2 weeks ago
Oh snap! That definitely sounds possible. Found more info about it.
tl;dr: Either the attack is ineffective against some browsers that check the certificate transparency logs (like Chrome), or the attack is visible and the CA will lose all its credibility (hopefully being removed from the browsers).
WhyJiffie@sh.itjust.works 2 weeks ago
it seems Firefox started doing the CT validation too, without needing to contact the CT log service: developer.mozilla.org/…/Certificate_Transparency#…
WhyJiffie@sh.itjust.works 2 weeks ago
and details: wiki.mozilla.org/…/Certificate_Transparency
this sounds important:
this also means, it can’t truly verify SCT’s that were issued since the last browser update?