Comment by 8organicbits | Hacker News Reader

Comment by 8organicbits | Hacker News Reader

Parent Full thread

I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. Public CAs give you certificate transparency and you can subscribe to events to detect mis-issuance. Some hosted private CAs like AWS's offer logs [5], but DIY setups don't.

Even still, there are a lot of folks happily using private CAs, they aren't the target audience for this initial release.

[1] https://github.com/FiloSottile/mkcert/issues/302

[2] https://github.com/cert-manager/cert-manager/issues/3655

[3] https://alexsci.com/blog/name-non-constraint/

[4] https://github.com/Netflix/bettertls/issues/19

[5] https://docs.aws.amazon.com/privateca/latest/userguide/secur...

Let me put it this way;

You might get away with installing your RootCA on your in-office PCs that you own.

Good luck though getting me to install it on my (external contractor) laptop or my (employee) phone, or my (hosted) VMS machines. -you- may plan to only use the CA for good, but I don't trust you (and by extension all your IT staff, present, past, and future) to be angels.

Exactly. It's one of the reasons I use separate VMs per client when I freelance. I want to install the cert, so I don't see the cert warning messages or accidentally click through a real MITM attack, but never on the host OS. That could let the client MITM all sorts of stuff like my email to other clients if Thunderbird syncs at a client site.

Kinda nuts actually that you can’t install a Root CA and tell the OS “but only ever use it for these and these domains”. That would solve this elegantly.

Even If you could tell the OS it would fail cause much (most?) software has an OS independent path to validate the certificate.

OpenSSL for example uses a custom pem file that the program developer supplies.

> Your private root CA can be maliciously used to MITM every domain on the Internet

I cannot see how. Do you mean as a specific attack on a computer with the private Root CA installed, if the attacker gets their hands on the Root CA private key?

I think OP was envisaging the attack being done by the person whose root CA private key it is.

> I think OP was envisaging the attack being done by the person whose root CA private key it is.

Still very convoluted. I cannot see the problem, beyond some very special cases.

There's two parts. The first is getting access to the private CA's private key. This is easy for insiders who already have access, but challenging for external attackers. The second is performing a MITM attack. You need to establish an in-the-middle network position and then craft certs for the sites you want to intercept. Insiders may already have the needed network position. Outsiders may find this challenging. Crafting a bogus certificate is trivial with a private CA.

Your private root CA can only be used maliciously if it's compromised. If you use certificate transparency to publicly leak all your local network administrative activities, then you won't need to worry about someone compromising your network because you've already compromised yourself.

The risk in both of theses is vastly different.

A root CA leak is hard to detect, has tremendous consequences, and adding limitations to the cert (TLD/domain) don’t work across every OS.

OTOH, leaking the existence of your private services (which are likely inaccessible over the internet for the general attacker) is a much smaller risk, and can be contained with wildcard certs as a workaround.

Compromise of private CAs isn't always difficult. People store unencrypted keys on SharePoint or send them in email along with the password. There's also cases of rogue IT department staff using the private CA intended to be used for `*.corp` to MITM employee Internet traffic, so "compromise" isn't needed for harm to occur. For companies that do it right, yeah, the concern is minimal.

I think the risk of leaking internal domain names is real, but overblown. If you find a vulnerable internal service via CT logs you still need to connect to the private network to exploit it. If you're connected to the private network, you could have enumerated subdomains many other ways. Early knowledge of vulnerable subdomains can speed up an attack or target selection, but this is still a two step process. Most subdomains are pretty boring anyway; it's not surprising to learn that $corp has subdomains like webmail, wiki, etc. These names don't leak version or brand information.

I was playing with the idea of doing CT log poisoning, where you register and renew certificates for decoy subdomains along side your real subdomain names. If you add enough noise, CT logs are no longer useful for enumerating private subdomains.

Sharepoint and email servers aren't public. Transparency logs are. Small companies might not care if the public knows what they're doing. In fact they'd probably benefit from the attention. However other companies are concerned, since leaks can fuel media rumors, harmful stock trades, or worse.

More to the point if you cannot keep one file a secret your problems are quite large.

Those sort of problems are common, true. That is saying that competence is rare in computing.

That is not surprising given the almost complete lack of accountability in this space.

Reply on news.ycombinator.com