Hacker News Reader

However, _that_ website is not served over HTTPS, which would seem to make it a prime target of MITM. Do you happen to have an HTTPS link to obtain these certs?

View on HN

Official source is here. The "MilitaryCAC" download link is publicly accessible, and uses SSL: https://militarycac.com/dodcerts.htm

Alternatively, the DoD certs served up securely by Symantec: https://knowledge.symantec.com/support/eca-support/index?pag...

MilitaryCAC is not an official source, it's about using CACs on personally-owned computers.

I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons, as there are lots of things that download stuff automatically from DISA. I could be wrong though, and I agree that it should be served over HTTPS. The main DISA page is served over HTTPS: https://www.disa.mil

> I haven't found one, but I suspect the IASE page is only over HTTP for legacy reasons

Well, also because an HTTPS page would create a chicken-and-egg situation. How do you download the root certs if you can't see the page because you don't have the root certs? etc

> there are lots of things that download stuff automatically from DISA

So, programs are downloading certs automatically, where they would be even less likely to properly check checksums against a secure site. And create a additional small attack vector.

Reply on news.ycombinator.com