0

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now from it behaves issues EV or regular certificates to malicious domains that end up in CT logs and as consequence browsers trust this certificates.

Ghost Rider
  • 423
  • 3
  • 10
  • I think this is answered in the linked question, specifically "Certificate Transparency moves certificate signing into the public view. Cooperating CAs immediately publish the details of every certificate they sign to one of several public logs maintained outside of the CA's control.". This of course depends on somebody actually watching the logs for irregularities – Steffen Ullrich Sep 16 '22 at 07:37
  • @SteffenUllrich that answer doesn't provide details how CT validates hacked CA. "CAs immediately publish the details of every certificate they sign to one of several public logs maintained outside of the CA's control." - this reply doesn't cover a case when CA itself is hacked, for example as it was with Comodo – Ghost Rider Sep 16 '22 at 08:24
  • A CA has to publish in to the CT logs all the issued certificates - certificates without this are not accepted by the browsers. Everyone can watch which certificates are issued and critical actors like google, facebook etc will quickly realize if someone is issuing certificates for their domains. So it will not be seen if a CA is hacked, but it will be seen what the attacker does with the hacked CA (issuing certificates). What else do you expect in an answer? – Steffen Ullrich Sep 16 '22 at 08:34
  • @SteffenUllrich you almost answered my question. So it will not be seen if a CA is hacked, but it will be seen what the attacker does with the hacked CA (issuing certificates). - does it mean that certificates from hacked CA will be valid for some time (minutes or hours) until the issued certificates by hacker will be revoked? – Ghost Rider Sep 16 '22 at 14:45
  • Yes, CT helps in detecting a compromised CA only after certificates were successfully issued. So it is not fully preventing any harm, it only make fast detection possible and thus reduces the impact of a successful attack. – Steffen Ullrich Sep 16 '22 at 14:54
  • @SteffenUllrich Now it makes sense for me. Last detail that I would like to clarify - you said Everyone can watch which certificates are issued and critical actors like google, facebook etc will quickly realize if someone is issuing certificates for their domains. - what happens if hacked CA will issue certificates to new domains not associated with big companies, just $(random_string).com - and hacked CA will not declare itself as hacked to save reputation? – Ghost Rider Sep 17 '22 at 01:19
  • Good question, we had this in the past were CA deemed to be too big too fail and got away even when they obviously did wrong, The power has shifted though since there are some really powerful companies on the browser site. Read what happened to DigiNotar or Symantec. Companies no longer need to admit a hack or internal wrongdoing when there is publicly visible proof. – Steffen Ullrich Sep 17 '22 at 04:23
  • @SteffenUllrich got it, thanks for the explanation, it was quite helpful for me! – Ghost Rider Sep 17 '22 at 13:36

0 Answers0