Sign in / Join
1939

Cheating Chinese certificate authorities, caught by Certificate Transparency, will get the death penalty

In 2012, Google introduced Certificate Transparency, an internet-wide tripwire system designed to catch cryptographic "certificate authorities" who abused their position to produce counterfeit credentials that would allow criminals, governments and police to spy on and tamper with secure internet connections.

Since then, CT has caught some pretty egregious offenders, most notably Symantec, whose certificates were phased out of the web earlier this year after being caught in repeated cheats and malpractice.

Now Google — with help from Mozilla — is giving the internet death penalty to WoSign and its subsidiary StartCom, Chinese Certificate Authorities who have been caught forging multiple certificates, including fake Github credentials.

The move to begin blacklisting the CA authority occurred last year. In August 2016, WoSign was caught issuing fake HTTPS certificates for GitHub domains, which are a severe security risk as attackers could use the certificate to impersonate GitHub domains to compromise user communications.

Google and Mozilla then teamed up to investigate the CA and managed to uncover other instances of unauthorized certificates being issued.

Chrome version 56 was the first to disallow certificates issued by WoSign and StartCom, after "technical limitations and concerns" raised concerns that the CA was not complying with Chrome’s Certificate Transparency policy.

Mozilla also announced plans to ban new certificates signed off by WoSign and StartCom through Firefox 51, released in January.

Play Video

Play

Loaded: 0%

Progress: 0%

Remaining Time -0:00

This is a modal window.

Foreground — White Black Red Green Blue Yellow Magenta Cyan — Opaque Semi-Opaque

Background — White Black Red Green Blue Yellow Magenta Cyan — Opaque Semi-Transparent Transparent

Window — White Black Red Green Blue Yellow Magenta Cyan — Opaque Semi-Transparent Transparent

Font Size 50% 75% 100% 125% 150% 175% 200% 300% 400%

Text Edge Style None Raised Depressed Uniform Dropshadow

Font Family Default Monospace Serif Proportional Serif Monospace Sans-Serif Proportional Sans-Serif Casual Script Small Caps

Defaults Done