On Thu, June 16, 2016 13:53, Walter H. wrote:> On 15.06.2016 16:17, Warren Young wrote: >> but it also affects the other public CAs: you can???t get a >> publicly-trusted cert for a machine without a publicly-recognized >> and -visible domain name. For that, you still need to use >> self-signed certs or certs signed by a private CA. >> > A private CA is the same as self signed; >No it is not. A private CA is as trustworthy as the organisation that operates it. No more and not one bit less. We operate a private CA for our domain and have since 2005. We maintain a public CRL strictly in accordance with our CPS and have our own OID assigned. Our CPS and CRL together with our active, expired and revoked certificate inventory is available online at ca.harte-lyne.ca. Our CPS states that we will only issue certificates for our own domain and furthermore we only issue them for equipment and personnel under our direct control. In a few years DANE is going to destroy the entire market of 'TRUSTED' root CA's -- because really none of them are trust 'worthy' --. And that development is long overdue. When we reach that point many domains, if not most, will have their DNS forward zones providing TLSA RRs for their domain CA certificates and signatures. And most of those that do this are going to be running their own private CA's simply to maintain control of their certificates. Our DNS TLSA flags tell those that verify using DANE that our private CA is the only authority that can issue a valid certificate for harte-lyne.ca and its sub-domains. Compare that to the present case wherein any 'trusted' CA can issue a certificate for any domain whatsoever; whether they are authorised by the domain owner or not[1]. So in a future with DANE it will be possible to detect when an apparently 'valid' certificate is issued by a rogue CA. The existing CA structure could not have been better designed for exploitation by special interests. It has been and continues to be so exploited. Personally I distrust every one of the preloaded root CAs shipped with Firefox by manually removing all of their trust flags. I do the same with any other browser I use. I then add back in those trusts essential for my browser operation as empirical evidence warrants. So I must trust certain DigiCert certificates for GitHub and DuckDuckGo, GeoTrust for Google, COMODO for Wikipedia, and so forth. These I set the trust flags for web services only. The rest can go pound salt as we used to say. [1] https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ -- *** e-Mail is NOT a SECURE channel *** Do NOT transmit sensitive data via e-Mail Do NOT open attachments nor follow links sent by e-Mail James B. Byrne mailto:ByrneJB at Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3
On 17/06/16 15:46, James B. Byrne wrote:> > On Thu, June 16, 2016 13:53, Walter H. wrote: >> On 15.06.2016 16:17, Warren Young wrote: >>> but it also affects the other public CAs: you can???t get a >>> publicly-trusted cert for a machine without a publicly-recognized >>> and -visible domain name. For that, you still need to use >>> self-signed certs or certs signed by a private CA. >>> >> A private CA is the same as self signed; >> > > No it is not. A private CA is as trustworthy as the organisation that > operates it. No more and not one bit less. > > We operate a private CA for our domain and have since 2005. We > maintain a public CRL strictly in accordance with our CPS and have our > own OID assigned. Our CPS and CRL together with our active, expired > and revoked certificate inventory is available online at > ca.harte-lyne.ca. Our CPS states that we will only issue certificates > for our own domain and furthermore we only issue them for equipment > and personnel under our direct control. > > In a few years DANE is going to destroy the entire market of 'TRUSTED' > root CA's -- because really none of them are trust 'worthy' --. And > that development is long overdue. When we reach that point many > domains, if not most, will have their DNS forward zones providing TLSA > RRs for their domain CA certificates and signatures. And most of > those that do this are going to be running their own private CA's > simply to maintain control of their certificates. > > Our DNS TLSA flags tell those that verify using DANE that our private > CA is the only authority that can issue a valid certificate for > harte-lyne.ca and its sub-domains. Compare that to the present case > wherein any 'trusted' CA can issue a certificate for any domain > whatsoever; whether they are authorised by the domain owner or not[1]. > So in a future with DANE it will be possible to detect when an > apparently 'valid' certificate is issued by a rogue CA. > > The existing CA structure could not have been better designed for > exploitation by special interests. It has been and continues to be so > exploited. > > Personally I distrust every one of the preloaded root CAs shipped with > Firefox by manually removing all of their trust flags. I do the same > with any other browser I use. I then add back in those trusts > essential for my browser operation as empirical evidence warrants. > So I must trust certain DigiCert certificates for GitHub and > DuckDuckGo, GeoTrust for Google, COMODO for Wikipedia, and so forth. > These I set the trust flags for web services only. The rest can go > pound salt as we used to say. > > > [1] > https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ >https://harte-lyne.ca/ net::ERR_CERT_AUTHORITY_INVALID
On 17.06.2016 16:46, James B. Byrne wrote:> On Thu, June 16, 2016 13:53, Walter H. wrote: >> On 15.06.2016 16:17, Warren Young wrote: >>> but it also affects the other public CAs: you can???t get a >>> publicly-trusted cert for a machine without a publicly-recognized >>> and -visible domain name. For that, you still need to use >>> self-signed certs or certs signed by a private CA. >>> >> A private CA is the same as self signed; >> > No it is not. A private CA is as trustworthy as the organisation that > operates it. No more and not one bit less. > > We operate a private CA for our domain and have since 2005. We > maintain a public CRL strictly in accordance with our CPS and have our > own OID assigned.for your understanding: every root CA certificate is self signed; any SSL certificate that was signed by a CA not delivered as built-in token in a browser is the same as self-signed;
On Fri, June 17, 2016 9:56 am, Michael H wrote:> On 17/06/16 15:46, James B. Byrne wrote: >> On Thu, June 16, 2016 13:53, Walter H. wrote: >>> On 15.06.2016 16:17, Warren Young wrote: >>>> but it also affects the other public CAs: you can???t get a >>>> publicly-trusted cert for a machine without a publicly-recognized and-visible domain name. For that, you still need to use>>>> self-signed certs or certs signed by a private CA. >>> A private CA is the same as self signed; >> No it is not. A private CA is as trustworthy as the organisation thatoperates it. No more and not one bit less.>> We operate a private CA for our domain and have since 2005. Wemaintain a public CRL strictly in accordance with our CPS and have our own OID assigned. Our CPS and CRL together with our active, expired and revoked certificate inventory is available online at>> ca.harte-lyne.ca. Our CPS states that we will only issue certificatesfor our own domain and furthermore we only issue them for equipment and personnel under our direct control.>> In a few years DANE is going to destroy the entire market of 'TRUSTED'root CA's -- because really none of them are trust 'worthy' --. And that development is long overdue. When we reach that point many domains, if not most, will have their DNS forward zones providing TLSA RRs for their domain CA certificates and signatures. And most of those that do this are going to be running their own private CA's simply to maintain control of their certificates.>> Our DNS TLSA flags tell those that verify using DANE that our privateCA is the only authority that can issue a valid certificate for harte-lyne.ca and its sub-domains. Compare that to the present case wherein any 'trusted' CA can issue a certificate for any domain whatsoever; whether they are authorised by the domain owner or not[1].>> So in a future with DANE it will be possible to detect when an >> apparently 'valid' certificate is issued by a rogue CA. >> The existing CA structure could not have been better designed forexploitation by special interests. It has been and continues to be so exploited.>> Personally I distrust every one of the preloaded root CAs shipped withFirefox by manually removing all of their trust flags. I do the same with any other browser I use. I then add back in those trusts>> essential for my browser operation as empirical evidence warrants. So Imust trust certain DigiCert certificates for GitHub and>> DuckDuckGo, GeoTrust for Google, COMODO for Wikipedia, and so forth.These I set the trust flags for web services only. The rest can go pound salt as we used to say.>> [1] >> https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ > > > https://harte-lyne.ca/ > > net::ERR_CERT_AUTHORITY_INVALID >Michael, no offense intended, but I really would suggest to do some reading instead of quoting what web browser tells you here. James gives excellent explanations, and all of them are extremely instructive. But one really needs to do a bit of reading to follow them. In a nut shell: what James described is exactly as the CA authorities operate with slight difference: propagation of private CA trust to clients. Again, please, do some reading on the subject and then re-read what James posted. Please, do not take it as offense, James' write up is really instructive, everyone of us who ever run own Certification Authority will attest to that. Valeri ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++
On Fri, 2016-06-17 at 15:56 +0100, Michael H wrote:> On 17/06/16 15:46, James B. Byrne wrote:> > > > We operate a private CA for our domain and have since 2005. We > > maintain a public CRL strictly in accordance with our CPS and have our > > own OID assigned. Our CPS and CRL together with our active, expired > > and revoked certificate inventory is available online at > > ca.harte-lyne.ca. Our CPS states that we will only issue certificates > > for our own domain and furthermore we only issue them for equipment > > and personnel under our direct control.> https://harte-lyne.ca/ > > net::ERR_CERT_AUTHORITY_INVALIDYour connection is not secure The owner of harte-lyne.ca has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. -- Regards, Paul. England, EU. England's place is in the European Union.