So if a bad actor gets access to one of the intermediate CA certificates they can run all sorts of MITM attacks, right? What are the chances that government agencies don’t have a bunch of private keys from CA that are not obviously wrong? 0, right? So we should just assume that government agencies can do MITM whenever they want?
In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but your http client library probably doesn’t - and this is why these compromised keys are a problem).
Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate something went really wrong at a CA and that CA would probably lose all the credibility and trust.
Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert.
Yes, but if it’s not used for a website but VPN for example. If NSA got a private key from some compromised CA and did MITM on some VPN users, would anyone notice?
One thing I don’t understand…
So if a bad actor gets access to one of the intermediate CA certificates they can run all sorts of MITM attacks, right? What are the chances that government agencies don’t have a bunch of private keys from CA that are not obviously wrong? 0, right? So we should just assume that government agencies can do MITM whenever they want?
Cloudflare is the largest MITM hiding in plain sight.
And everyone gives them voluntarily their private keys.
Yes, government agencies can do MITM whenever they want.
Also, take a look at the remote management functionality of your computer.
It’s actually possible to prevent impersonation:
In theory all the generated keys are added to a public certificate transparancy log. Browsers should check that the key is there (but your http client library probably doesn’t - and this is why these compromised keys are a problem).
Website owners should also check that there are no other certificates in there, and if they see an extra misissued certificate something went really wrong at a CA and that CA would probably lose all the credibility and trust.
Also when you request a certificate the CA doesn’t get your private keys, so they can’t reuse your cert.
Example: https://ctlogs.dev/search?q=Programming.dev
Yes, but if it’s not used for a website but VPN for example. If NSA got a private key from some compromised CA and did MITM on some VPN users, would anyone notice?