8 ms·

Final Removal of Trust in WoSign and StartCom Certificates

162 points by selectnull 9y ago

brian_herman 9y ago
Is there a tool that we can use to tell if we have these certs?
- ivanr 9y ago
  Are you asking because you have a large number of hosts and can't check them all manually? (Edit: Because the obvious answer is to use your browser or a tool such as SSL Labs or Hardenize to see who issued the certificate.) Out of curiosity, how many hosts are you looking after?
- Rjevski 9y ago
  A script running openssl s_client would do the trick.
- theossuary 9y ago
  It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2]. Note, I haven't been able to test that script on an actually broken site with a Wosign certificate [1]: https://pastebin.com/ZVMM3PJZ https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...
  - ivanr 9y ago
    For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan https://github.com/ssllabs/ssllabs-scan However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.
- dom0 9y ago
  echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"
  - schoen 9y ago
    For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.
  - ivanr 9y ago
    That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too. Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.
  - aaronmdjones 9y ago
    No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null. $ openssl ... </dev/null | grep ... EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.
- svenfaw 9y ago
  Something to be aware of: on Windows, certain third-party executables are signed with a WoSign cert. One popular example being the npcap library (part of nmap). If you distrust WoSign roots, side effects may occur upon using nmap.
- jwilk 9y ago
  https://github.com/jwilk/skeptica https://github.com/jwilk/skeptica
fenwick67 9y ago
They are trying to crawl back: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824 https://bugzilla.mozilla.org/show_bug.cgi?id=1311824
jbergstroem 9y ago
Speaking of removing trust bits; the ever-delayed Symantec saga continues with no clear decision. What concerns me is: - the lack of public communication, as shown here (tl;dr: private meetings): https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k3PaF0UoE0I https://groups.google.com/forum/#!topic/mozilla.dev.security... - the contrast between symantec and the mozilla security groups path forward [as well as how its communicated] (https://groups.google.com/d/msg/mozilla.dev.security.policy/C45hQChFLyc/4HyG0iaMBAAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/..., https://www.symantec.com/connect/blogs/symantec-s-response-google-s-subca-proposal https://www.symantec.com/connect/blogs/symantec-s-response-g...)
- ivanr 9y ago
  I don't think you're being fair toward Mozilla. They had a meeting with Symantec and reported on it; there were no details because Symantec is going to soon publish everything. They probably had the meeting only because Gerv was in the area. Mozilla have been transparent the whole time. Google's approach is clearly different to that of Mozilla, but IIRC they have never pledged transparency. They're a commercial entity and they're doing what they think is right and/or is in their interests.
  - jbergstroem 9y ago
    I can understand how my comment might have come off as somewhat judgmental (to either side) but that was not my intention. The idea was to [without derailing the thread too much] give people interested in certificate issues a relatively quick summary on what has happened and my concern about it.
  - yuhong 9y ago
    I wonder if "senior executives" at Google are really involved.
- dxf 9y ago
  There is discussion on the Chromium blink-dev list: https://groups.google.com/a/chromium.org/d/topic/blink-dev/eUAKwjihhBs/discussion https://groups.google.com/a/chromium.org/d/topic/blink-dev/e...
JoshTriplett 9y ago
And meanwhile, Let's Encrypt is on track to offer wildcards at the start of next year (https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...), so one of the last reasons to need a non-LE cert is going away. I used StartCom for years, but LE made it completely obsolete for me. And StartCom seems to have been willing to throw it all away with the WoSign acquisition.
- justinclift 9y ago
  Lets Encrypt seems like a good solution for the https cert side of things. Wish there was an equivalent thing for signing executables. eg for the binaries of our software releases. We'd been using StartCom signing certs (for Win binaries) up until this clusterfk. ;)
  - ktta 9y ago
    There's always GPG signing.
    - justinclift 9y ago
      Technically correct, but it solves a different problem. The StartCom signing cert is a solution solving the "big scary warning" problem on Windows for untrusted binaries. GPG signing is suitable for a different group of users. :)
    - tonyedgecombe 9y ago
      Doesn't solve the Windows scary warnings issue.
    - khedoros1 9y ago
      Does that provide the same integration into Windows that Authenticode does? Plus timestamp, dualsign, and cross-sign?
      - deleted 9y ago
        [deleted]
bsou 9y ago
question for the knowledgeable: I've used AWS's ACM for my certs so far, are there any big reasons why I should be using LE instead?
- ivanr 9y ago
  No. Quite the opposite, AWS automates certificate issuance for you. You'd have to automate the process yourself if you switched to LE. Of course, AWS only issues certificates when you're using their stuff. For everything else, use LE :)
  - toomuchtodo 9y ago
    Nitpick: You can only use ACM with ELBs/ALBs/Cloudfront Distributions.
xoa 9y ago
I'm still really bummed about StartCom's suicide/implosion. They had by far the most sane and reasonable pricing model I've ever seen, and one I really wish someone else would do. They basically only charged for non-automatic authentication, not for what you did with that authentication, and then let each level of authentication feed into higher levels. So Level 1 machine auth (similar in spirit to LE) was entirely free, you could verify an email, domain, or whatever and then produce certs for that. If you wished you could pay money (~$60 for 2 years IIRC) to have an actual human look at your documentation and give you a call, then give you a Level 2 with your legal name. You could then use that for an unlimited number of S/MIME certs for email accounts, domains, software signing and so forth. Having gotten personal verification to level 2, you could then pay to have an organization certified. Etc. Their UI wasn't the best, but it was functional and the overall system made a lot of sense. They didn't put an artificial price on some bits with a marginal cost of nada. It's a real shame all that got flushed, because that model of business filled a hole that has no general world solution right now (in principle authentication of their citizens should be a core role and offering of modern government, but I'm not holding my breath there).
- yuhong 9y ago
  Thinking about it, we are lucky Debian moved to Gandi instead of StartCom when they ditched the SPI CA.
  - lwf 9y ago
    Gandi's been a long-time supporter of Debian[1], providing preferred pricing (their best "bulk rates") for years. I assume the CA migration was also donated. I'm personally quite glad the SPI CA is gone, and that we removed CACert[2][3]; stopped a lot of "works on my machine" confusion, and made the project more welcoming to people not already running a Debian derivative. [1]: https://www.gandi.net/supports/debian/ https://www.gandi.net/supports/debian/ [2]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718434 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718434 [3]: https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/1258286 https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+b...
- 9y ago
danjoc 9y ago
And yet, on my brand new Android Nougat phone, I have these StartCom and WoSign CAs. I just disabled them, but I doubt many users will.
- ElijahLynn 9y ago
  Thanks, just did this on my Pixel.
snakeanus 9y ago
I had hopped that they would do that much earlier. WoSign and StartCom acting in a shady way has been known for quite a long time.
- michaelt 9y ago
  Where can one learn what CAs are acting in a shady way? Are there other CAs on a similar course?
  - snakeanus 9y ago
    I would say that Comodo is quite shady, sadly it seems that cloudflare sites use it so getting rid of it would be quite difficult. They make multiple low quality and mostly useless applications - one could even call them scamware: https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security_Products https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security.... They also forked Chromium and Firefox and made their own rebranded browsers which offer nothing of value. They have multiple clearly fake comments on their certificate pages: https://ssl.comodo.com/comodo-ssl-certificate.php https://ssl.comodo.com/comodo-ssl-certificate.php and https://ssl.comodo.com/wildcard-ssl-certificates.php https://ssl.comodo.com/wildcard-ssl-certificates.php And finally they tried to trademark the name of LE: https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_trademark_registration_application https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_t...
microcolonel 9y ago
I fully encourage you folks to prune your trusted CAs. I personally whitelist only some CAs. I keep a separate root for visiting Chinese websites like Baidu Wenku.
- walrus01 9y ago
  it is frankly astonishing how many browsers/OS platforms ship by default trusting all of the major mainland chinese root CAs.
  - Tinyyy 9y ago
    It’s astonishing because somehow the Chinese deserve to be treated differently from everyone else?
    - walrus01 9y ago
      Because the Chinese government has a well documented track record of attempting to MITM SSL, and if your system trust the root CA... game over. https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=utf-8 https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=u...
walrus01 9y ago
Should have happened eight months ago. I can understand the careful and deliberative process behind the "CA death penalty" from a major browser, but this was such an egregious case that I think faster action was warranted.

162 points by selectnull 9y ago

brian_herman 9y ago

Is there a tool that we can use to tell if we have these certs?

ivanr 9y ago
Are you asking because you have a large number of hosts and can't check them all manually? (Edit: Because the obvious answer is to use your browser or a tool such as SSL Labs or Hardenize to see who issued the certificate.) Out of curiosity, how many hosts are you looking after?
Rjevski 9y ago
A script running openssl s_client would do the trick.
theossuary 9y ago
It'd be pretty easy to check if the certificate is invalid using something like a bash script [1]. Or you could script ssllabs to check for you (they give the site a failing grade if the Wosign cert is found/invalid) [2]. Note, I haven't been able to test that script on an actually broken site with a Wosign certificate [1]: https://pastebin.com/ZVMM3PJZ https://pastebin.com/ZVMM3PJZ [2]: https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hideResults=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&hi...
- ivanr 9y ago
  For what it's worth, SSL Labs also has a command-line tool that enables you to scan in bulk https://github.com/ssllabs/ssllabs-scan https://github.com/ssllabs/ssllabs-scan However, although they don't trust WoSign and StartCom any more, it's possible that there is a cross-signed certificate to another CA, in which case the problem is not going to be detected. I seem to recollect that such cross-signed certs exist, but I haven't looked for them recently. Will do.
dom0 9y ago
echo | openssl s_client -connect somewhere.net:443 -servername somewhere.net | grep -qE "(WoSign)|(StartCom)"
- schoen 9y ago
  For more accurate browser-like results, you might want to add "-servername somewhere" so that you get the response associated with the "somewhere" virtual host rather than the default response.
- ivanr 9y ago
  That's a bit simplistic. For example, you at the very least want to have a "-servername" there to account for SNI-only hosts. You'll then need to worry about prefixed and non-prefixed hosts (e.g., www.example.com and example.com). Then, what do you do if your web site relies on a third-party sites that uses WoSign? Yes, now you have to parse the HTML response, extract all links, and check those too. Then there's also a question of servers other than HTTP, so you need to throw in a port scanner in there. And a tool to actively follow protocols, to discover MX hosts, maybe even look at SRV records, and so on.
- aaronmdjones 9y ago
  No need to prefix the command with `echo | '. If you want OpenSSL to have no standard input (so it closes its connection), just redirect standard input from /dev/null. $ openssl ... </dev/null | grep ... EDIT: This also avoids OpenSSL sending its only input character (the newline that echo produces) to the server, which will throw it away anyway.
svenfaw 9y ago
Something to be aware of: on Windows, certain third-party executables are signed with a WoSign cert. One popular example being the npcap library (part of nmap). If you distrust WoSign roots, side effects may occur upon using nmap.
jwilk 9y ago
https://github.com/jwilk/skeptica https://github.com/jwilk/skeptica

fenwick67 9y ago

They are trying to crawl back: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824 https://bugzilla.mozilla.org/show_bug.cgi?id=1311824

jbergstroem 9y ago

Speaking of removing trust bits; the ever-delayed Symantec saga continues with no clear decision. What concerns me is: - the lack of public communication, as shown here (tl;dr: private meetings): https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k3PaF0UoE0I https://groups.google.com/forum/#!topic/mozilla.dev.security... - the contrast between symantec and the mozilla security groups path forward [as well as how its communicated] (https://groups.google.com/d/msg/mozilla.dev.security.policy/C45hQChFLyc/4HyG0iaMBAAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/..., https://www.symantec.com/connect/blogs/symantec-s-response-google-s-subca-proposal https://www.symantec.com/connect/blogs/symantec-s-response-g...)

ivanr 9y ago
I don't think you're being fair toward Mozilla. They had a meeting with Symantec and reported on it; there were no details because Symantec is going to soon publish everything. They probably had the meeting only because Gerv was in the area. Mozilla have been transparent the whole time. Google's approach is clearly different to that of Mozilla, but IIRC they have never pledged transparency. They're a commercial entity and they're doing what they think is right and/or is in their interests.
- jbergstroem 9y ago
  I can understand how my comment might have come off as somewhat judgmental (to either side) but that was not my intention. The idea was to [without derailing the thread too much] give people interested in certificate issues a relatively quick summary on what has happened and my concern about it.
- yuhong 9y ago
  I wonder if "senior executives" at Google are really involved.
dxf 9y ago
There is discussion on the Chromium blink-dev list: https://groups.google.com/a/chromium.org/d/topic/blink-dev/eUAKwjihhBs/discussion https://groups.google.com/a/chromium.org/d/topic/blink-dev/e...

JoshTriplett 9y ago

And meanwhile, Let's Encrypt is on track to offer wildcards at the start of next year (https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html https://letsencrypt.org/2017/07/06/wildcard-certificates-com...), so one of the last reasons to need a non-LE cert is going away. I used StartCom for years, but LE made it completely obsolete for me. And StartCom seems to have been willing to throw it all away with the WoSign acquisition.

justinclift 9y ago
Lets Encrypt seems like a good solution for the https cert side of things. Wish there was an equivalent thing for signing executables. eg for the binaries of our software releases. We'd been using StartCom signing certs (for Win binaries) up until this clusterfk. ;)
- ktta 9y ago
  There's always GPG signing.
  - justinclift 9y ago
    Technically correct, but it solves a different problem. The StartCom signing cert is a solution solving the "big scary warning" problem on Windows for untrusted binaries. GPG signing is suitable for a different group of users. :)
  - tonyedgecombe 9y ago
    Doesn't solve the Windows scary warnings issue.
  - khedoros1 9y ago
    Does that provide the same integration into Windows that Authenticode does? Plus timestamp, dualsign, and cross-sign?
    - deleted 9y ago
      [deleted]

bsou 9y ago

question for the knowledgeable: I've used AWS's ACM for my certs so far, are there any big reasons why I should be using LE instead?

ivanr 9y ago
No. Quite the opposite, AWS automates certificate issuance for you. You'd have to automate the process yourself if you switched to LE. Of course, AWS only issues certificates when you're using their stuff. For everything else, use LE :)
- toomuchtodo 9y ago
  Nitpick: You can only use ACM with ELBs/ALBs/Cloudfront Distributions.

xoa 9y ago

I'm still really bummed about StartCom's suicide/implosion. They had by far the most sane and reasonable pricing model I've ever seen, and one I really wish someone else would do. They basically only charged for non-automatic authentication, not for what you did with that authentication, and then let each level of authentication feed into higher levels. So Level 1 machine auth (similar in spirit to LE) was entirely free, you could verify an email, domain, or whatever and then produce certs for that. If you wished you could pay money (~$60 for 2 years IIRC) to have an actual human look at your documentation and give you a call, then give you a Level 2 with your legal name. You could then use that for an unlimited number of S/MIME certs for email accounts, domains, software signing and so forth. Having gotten personal verification to level 2, you could then pay to have an organization certified. Etc. Their UI wasn't the best, but it was functional and the overall system made a lot of sense. They didn't put an artificial price on some bits with a marginal cost of nada. It's a real shame all that got flushed, because that model of business filled a hole that has no general world solution right now (in principle authentication of their citizens should be a core role and offering of modern government, but I'm not holding my breath there).

yuhong 9y ago
Thinking about it, we are lucky Debian moved to Gandi instead of StartCom when they ditched the SPI CA.
- lwf 9y ago
  Gandi's been a long-time supporter of Debian[1], providing preferred pricing (their best "bulk rates") for years. I assume the CA migration was also donated. I'm personally quite glad the SPI CA is gone, and that we removed CACert[2][3]; stopped a lot of "works on my machine" confusion, and made the project more welcoming to people not already running a Debian derivative. [1]: https://www.gandi.net/supports/debian/ https://www.gandi.net/supports/debian/ [2]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718434 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718434 [3]: https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/1258286 https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+b...
9y ago

danjoc 9y ago

And yet, on my brand new Android Nougat phone, I have these StartCom and WoSign CAs. I just disabled them, but I doubt many users will.

ElijahLynn 9y ago
Thanks, just did this on my Pixel.

snakeanus 9y ago

I had hopped that they would do that much earlier. WoSign and StartCom acting in a shady way has been known for quite a long time.

michaelt 9y ago
Where can one learn what CAs are acting in a shady way? Are there other CAs on a similar course?
- snakeanus 9y ago
  I would say that Comodo is quite shady, sadly it seems that cloudflare sites use it so getting rid of it would be quite difficult. They make multiple low quality and mostly useless applications - one could even call them scamware: https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security_Products https://en.wikipedia.org/wiki/Comodo_Group#Consumer_Security.... They also forked Chromium and Firefox and made their own rebranded browsers which offer nothing of value. They have multiple clearly fake comments on their certificate pages: https://ssl.comodo.com/comodo-ssl-certificate.php https://ssl.comodo.com/comodo-ssl-certificate.php and https://ssl.comodo.com/wildcard-ssl-certificates.php https://ssl.comodo.com/wildcard-ssl-certificates.php And finally they tried to trademark the name of LE: https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_trademark_registration_application https://en.wikipedia.org/wiki/Comodo_Group#Let.27s_Encrypt_t...

microcolonel 9y ago

I fully encourage you folks to prune your trusted CAs. I personally whitelist only some CAs. I keep a separate root for visiting Chinese websites like Baidu Wenku.

walrus01 9y ago
it is frankly astonishing how many browsers/OS platforms ship by default trusting all of the major mainland chinese root CAs.
- Tinyyy 9y ago
  It’s astonishing because somehow the Chinese deserve to be treated differently from everyone else?
  - walrus01 9y ago
    Because the Chinese government has a well documented track record of attempting to MITM SSL, and if your system trust the root CA... game over. https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=utf-8 https://www.google.com/search?q=china+ssl+mitm&ie=utf-8&oe=u...

walrus01 9y ago

Should have happened eight months ago. I can understand the careful and deliberative process behind the "CA death penalty" from a major browser, but this was such an egregious case that I think faster action was warranted.