1276146 - Revoke/Untrust BlueCoat SSL certificates

Status: RESOLVED DUPLICATE of bug 1237817

(CA Program :: CA Certificate Root Program, task)

Description

[primexx]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36

Steps to reproduce:

https://www.reddit.com/r/netsec/comments/4l7njb/apparently_bluecoat_is_now_a_ca_thanks/



Expected results:

BlueCoat just received CA certificates that will allow them to MITM anything they want. Please revoke their certificates ASAP.

Comment 1

[Rick Andrews]

We've published a blog about this. Please see http://www.symantec.com/connect/blogs/symantec-protocol-keeps-private-keys-its-control

Comment 2

[Matt Nordhoff (aka Peng on IRC & forums)]

Okay, i'll be That Guy.

Your blog post uses conspicuously ambiguous language. For example, "speculation that Blue Coast was issuing public certificates for other organizations is incorrect" does not deny issuing private certificates for other organizations. Or any certificates for individuals. If one interprets "for" as meaning "on behalf of", it fails to deny issuing malicious certificates for Blue Coat's own purposes.

I've been told that this intermediate's CPS is irregular as well.

Comment 3

[Rick Andrews]

The private keys were in Symantec's control at all times, so the only domain for which Blue Coat would have had the ability to issue certificates was limited to bluecoat.com, which went through our standard authentication process.

Comment 4

[h2g2bob]

The certificate can be viewed here: https://crt.sh/?id=19538258

(In reply to Rick Andrews from comment #3)
> the only domain [was] bluecoat.com

If it's only intended for *.bluecoat.com, then I'm confused why this is not technically enforced using an name and pathlen.

Comment 5

[Ángel]

Thanks for explaining Rick. Could you detail how was this restriction implemented?

Did bluecoat request the certificates through your website as usual, did you provide them an HSM… ?

Comment 6

[Rick Andrews]

Just to reiterate, the private keys were in Symantec’s control at all times and the intermediate CA has a pathlen of 0.
 
For customer-specific intermediate CAs, we do not typically employ name constraints because it limits legitimate, new domains that the company is authorized to use in the future. Instead, as in this case, the enforcement of which domains Blue Coat was allowed to issue is via our normal system and process checks, which enforce only domains that Blue Coat is authenticated for.

Comment 7

[Dallam]

(In reply to h2g2bob from comment #4)
> The certificate can be viewed here: https://crt.sh/?id=19538258
> 
> (In reply to Rick Andrews from comment #3)
> > the only domain [was] bluecoat.com
> 
> If it's only intended for *.bluecoat.com, then I'm confused why this is not
> technically enforced using an name and pathlen.

The cert can sign for any domain or subdomain outside of bluecoat.com and be used for MiTM by rugure nation states.

Comment 8

[primexx]

It should also solve the problem to remove "Class 3 Public Primary CA" altogether as Google has apparently already done with Chrome, and that's at Symantec's request.

Comment 9

[Kathleen Wilson]

(In reply to primexx from comment #8)
> It should also solve the problem to remove "Class 3 Public Primary CA"
> altogether as Google has apparently already done with Chrome, and that's at
> Symantec's request.

You might want to read about this a bit more, to see that there are several versions of the Class 3 PCA root cert. 
I believe that all of the major root stores removed the G1 and G2 versions of this root already, which is what I believe you were referring to.
Firefox removed them via Bug #1237817 (Firefox 46), and the websites trust bit had previously been turned off in Firefox 32.

Comment 10

[primexx]

(In reply to Kathleen Wilson from comment #9)
> (In reply to primexx from comment #8)
> > It should also solve the problem to remove "Class 3 Public Primary CA"
> > altogether as Google has apparently already done with Chrome, and that's at
> > Symantec's request.
> 
> You might want to read about this a bit more, to see that there are several
> versions of the Class 3 PCA root cert. 
> I believe that all of the major root stores removed the G1 and G2 versions
> of this root already, which is what I believe you were referring to.
> Firefox removed them via Bug #1237817 (Firefox 46), and the websites trust
> bit had previously been turned off in Firefox 32.

Ah, the Google announcement didn't name them but the hashes seem to suggest that yes. https://security.googleblog.com/2015/12/proactive-measures-in-digital.html

Comment 11

[Kathleen Wilson]

I believe Bug #1237817 resolved this by removing the corresponding root certs from Firefox 46.