Beware of Applications Misusing Root Stores

This sounds like a serious issue, and I wouldn't be surprised if news will come out soon about an app that allows for a massive security breach because it didn't use the root store correctly.

S/MIME and HTTPS are quite different types of services, the former still usually relying on long-lived certificates whilst the latter is moving to shorter and shorter certificate validity, lessening the impact of a breach. Using S/MIME certificates to validate TLS might even allow a website to use the certificate of some random email address in your company to do a man-in-the-middle attack on your certificate, if the app's implementation was written badly enough.

--

Offtopic: speaking of root stores and Mozilla, I'm still miffed about Firefox's decisions about the subject on Android. They removed the old root certificate management/installation pages, put a switch to enable the system's user certificate store in about:config and then removed the ability to use about:config from the stable release of Firefox for Android.

I've seen a commit message saying that they moved the setting to allow the certificates the user explicitly installed on their system to work inside Firefox into a secret developer menu. I found that thread because I was looking into why my phone would randomly reset the about:config setting every day (because of a bug? because of the change? who even knows).

My intranet websites work on pretty much every browser other than Firefox on my phone. It's really annoying.

> Additionally, some application developers directly parse a file in Mozilla’s source code management system called certdata.txt, in which Mozilla’s root store is maintained in a form that is convenient for NSS to build from. The problem with the scripts that directly parse this file is that some of the certificates in this file are not trusted but rather explicitly distrusted

Could the file be split to retroactively fix everyone doing this?

Cryptosystems are hard. I've been thinking a lot lately about cryptosystems, and my thinking is that there's entirely too much complexity in this space: What works is keeping things simple.

RE: CA Lists: Your CA list should be as short as it can be. The public CA list should be the public CA list, and you should use Mozilla's HTTPS list or Google's Chrome Root Store... but these lists are public lists for public infrastructure, and what you should use for communicating with services you don't control.

Every company should have a CA. Possibly every division of every company. Don't throw them all in the same file. You should, as a client, make use of TLS Contexts: You should specify for every HTTPS Client a specific CA, which for internal services should be your own CA.

As a server, client certificate auth is pretty rare (but it shouldn't be). When you do have it, you don't always have control over the client's root CA, but you shouldn't blindly trust it, either. You must verify that the claims on the client certificate match the claims on the CA, but also that the claims on the CA match your actual trust of the CA. The latter shouldn't be done at runtime, but during configuration. You shouldn't accept blind root signing certificates; You should accept from your clients intermediate CAs with appropriate constraints baked in.

This brings into the equation another important problem: You shouldn't have complex claims on client certificates.

I'm watching closely the SPIFFE project [1], which I believe is well intentioned but don't believe has got it right. I've also got my own project, KubeTLS[2] which implements a simple claims system - Which is appropriate in very limited constraints, but I believe those constraints also match most businesses real-world needs.

[1] https://spiffe.io/ [2] https://gitlab.com/gauntletwizard_net/kubetls

I feel like I'm missing some context here - they say applications are using the Mozilla root store "for purposes other than what Mozilla’s root store is curated for", but they never actually say what those purposes are. I wonder if they don't think it matters or if they're being deliberately secretive because there's an unpatched exploit floating around somewhere? That said, I can't come up with what somebody could be using a root store for besides validating a certificate.

I think I'm missing some understanding. Does this include companies like Netskope that inject themselves into a systems root trust chain to MITM TLS communication?