Biz & IT

Still fuming over HTTPS mishap, Google makes Symantec an offer it can’t refuse

Google: Fix ailing certificate business or risk having Chrome flag your credentials.

Dan Goodin – Oct 29, 2015 5:10 AM | 127

Google has given Symantec an offer it can't refuse: give a thorough accounting of its ailing certificate authority process or risk having the world's most popular browser—Chrome—issue scary warnings when end users visit HTTPS-protected websites that use Symantec credentials.

The ultimatum, made in a blog post published Wednesday afternoon, came five weeks after Symantec fired an undisclosed number of employees caught issuing unauthorized transport layer security certificates. The mis-issued certificates made it possible for the holders to impersonate HTTPS-protected Google webpages.

Symantec first said it improperly issued 23 test certificates for domains owned by Google, browser maker Opera, and three other unidentified organizations without the domain owners' knowledge. A few weeks later, after Google disputed the low number, Symantec revised that figure upward, saying it found an additional 164 certificates for 76 domains and 2,458 certificates for domains that had never been registered. The mis-issued certificates represented a potentially critical threat to virtually the entire Internet population because they made it possible for the holders to cryptographically impersonate the affected sites and monitor communications sent to and from the legitimate servers.

"It’s obviously concerning that a CA would have such a long-running issue and that they would be unable to assess its scope after being alerted to it and conducting an audit," Ryan Sleevi, a software engineer on the Google Chrome team, wrote in the blog post.

He went on to require that, beginning in June, Symantec publicly log all certificates it issues or risk having Chrome flag them as potentially unsafe. Currently, under the Chrome certificate transparency policy, Symantec and all other Chrome-trusted CAs must log all extended validation certificates—that is, TLS credentials that certify a site is owned by a specific organization, such as PayPal, Microsoft, or Bank of America. Beginning June 1, Symantec will be required to log all certificates, not just those with the extended validation flag.

In language that was uncharacteristically stern, Sleevi continued:

After this date, certificates newly issued by Symantec that do not conform to the Chromium Certificate Transparency policy may result in interstitials or other problems when used in Google products.

More immediately, we are requesting of Symantec that they further update their public incident report with:

A post-mortem analysis that details why they did not detect the additional certificates that we found.

Details of each of the failures to uphold the relevant Baseline Requirements and EV Guidelines and what they believe the individual root cause was for each failure.

We are also requesting that Symantec provide us with a detailed set of steps they will take to correct and prevent each of the identified failures, as well as a timeline for when they expect to complete such work. Symantec may consider this latter information to be confidential and so we are not requesting that this be made public.

Following the implementation of these corrective steps, we expect Symantec to undergo a Point-in-time Readiness Assessment and a third-party security audit. The point-in-time assessment will establish Symantec’s conformance to each of these standards:

WebTrust Principles and Criteria for Certification Authorities

WebTrust Principles and Criteria for Certification Authorities – SSL Baseline with Network Security

WebTrust Principles and Criteria for Certification Authorities – Extended Validation SSL

The third-party security audit must assess:

The veracity of Symantec’s claims that at no time private keys were exposed to Symantec employees by the tool.

That Symantec employees could not use the tool in question to obtain certificates for which the employee controlled the private key.

That Symantec’s audit logging mechanism is reasonably protected from modification, deletion, or tampering, as described in Section 5.4.4 of their CPS.

We may take further action as additional information becomes available to us.

Symantec has issued a statement in response. It reads:

In September, we were alerted that a small number of test certificates for Symantec’s internal use had been mis-issued. We immediately began publicly investigating our full test certificate history and found others, most of which were for non-existent and unregistered domains. While there is no evidence that any harm was caused to any user or organization, this type of product testing was not consistent with the policies and standards we are committed to uphold. We confirmed that these test certificates have all been revoked or have expired, and worked directly with the browser community to have them blacklisted. To prevent this type of testing from occurring in the future, we have already put additional tool, policy and process safeguards in place, and announced plans to begin Certificate Transparency logging of all certificates. We have also engaged an independent third-party to evaluate our approach, in addition to expanding the scope of our annual audit.

The prospect of Chrome flagging every newly issued TLS certificate is sure to strike fear in the hearts of Symantec executives, since potential customers would almost surely choose a competing CA whose credentials don't get this treatment. The demand for a "point-in-time readiness assessment," meanwhile, can be seen as the certificate-authority equivalent of a misbehaving student being sent to the principal's office. Generally, such assessments are required for CAs to become accredited in the first place. And while CAs are required to undergo a security audit every year or so, the added requirements spelled out by Sleevi are likely to make the next audit cost additional money and effort.

The message is clear. Too many certificate authorities—whether they're the China Network Information Center, the French cyberdefense agency known as ANSSI, India's National Informatics Centre, or the now defunct Dutch CA DigiNotar—have been allowed to get away with too much for too long. Google is using its considerable influence as the maker of the world's most popular browser to warn them that there will be some extremely unpleasant consequences for future violations (though in fairness, some argue that Google would have taken this approach even if Chrome had a smaller market share).

Post updated to add comment from Symantec.

Dan Goodin Senior Security Editor

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

127 Comments