Hacker News Reader

Comment by Kadin | Hacker News Reader

For those who are interested (probably not necessary on a Mac as they may be preinstalled), the DOD CA certs can be freely downloaded from DISA:

http://iase.disa.mil/pki-pke/Documents/unclass-installroot_v...

There are (impressively thorough, including recommendations on out-of-band fingerprint authentication) installation instructions included, and they provide PEM, PKCS7, and some weirdo Windows format.

View on HN

However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?

Official source is here. The "MilitaryCAC" download link is publicly accessible, and uses SSL: https://militarycac.com/dodcerts.htm

Alternatively, the DoD certs served up securely by Symantec: https://knowledge.symantec.com/support/eca-support/index?pag...

MilitaryCAC is not an official source, it's about using CACs on personally-owned computers.

I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons, as there are lots of things that download stuff automatically from DISA. I could be wrong though, and I agree that it should be served over HTTPS. The main DISA page is served over HTTPS: https://www.disa.mil

> I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons

Well, also because an HTTPS page would create a chicken-and-egg situation. How do you download the root certs if you can't see the page because you don't have the root certs? etc

> there are lots of things that download stuff automatically from DISA

So, programs are downloading certs automatically, where they would be even less likely to properly check checksums against a secure site. And create a additional small attack vector.

Reply on news.ycombinator.com