Sectigo: Use of forbidden subjectPublicKeyInfo algorithm
Categories
(CA Program :: CA Certificate Compliance, task)
Tracking
(Not tracked)
People
(Reporter: ryan.sleevi, Assigned: Robin.Alden)
References
Details
(Whiteboard: [ca-compliance] [ov-misissuance] [dv-misissuance])
The following problems have been found in certificates issued by your CA, and reported in the mozilla.dev.security.policy forum. Direct links to those discussions are provided for your convenience.
Please provide an incident report, as described at https://wiki.mozilla.org/CA/Responding_To_An_Incident#Incident_Report
The problems reported for your CA in the mozilla.dev.security.policy forum are as follows:
P-521 in certificates: https://groups.google.com/d/msg/mozilla.dev.security.policy/4gs5pKqTeK8/9XyMgrW8BgAJ
Reporter | ||
Comment 1•6 years ago
|
||
Robin: Please provide a response.
Assignee | ||
Comment 2•6 years ago
|
||
We have made an immediate code-change so that no further end entity TLS certificates may be issued that include a P-521 subscriber public key.
Since these certificates comply with the Baseline Requirements we are not clear whether (and in what timescale) Mozilla requires revocation of these certificates.
I will provide a fuller response by tomorrow.
Updated•6 years ago
|
Reporter | ||
Updated•6 years ago
|
Assignee | ||
Comment 3•6 years ago
|
||
- How your CA first became aware of the problem (e.g. via a problem report submitted to your Problem Reporting Mechanism, a discussion in mozilla.dev.security.policy, a Bugzilla bug, or internal self-audit), and the time and date.
We say Corey's post to m.d.s.p. at about 10am UTC, Jan 8, 2019.
- A timeline of the actions your CA took in response. A timeline is a date-and-time-stamped sequence of all relevant events. This may include events before the incident was reported, such as when a particular requirement became applicable, or a document changed, or a bug was introduced, or an audit was done.
00:00 February 28, 2017 Mozilla's Root Store Policy Archive shows that version 2.4 of the Root Store Policy had it's compliance date.
10:00 January 8, 2019 Corey's post to m.d.s.p.
18:00 January 8, 2019 Code released to live so that no further certificates with P-521 keys will be issued.
- Whether your CA has stopped, or has not yet stopped, issuing certificates with the problem. A statement that you have will be considered a pledge to the community; a statement that you have not requires an explanation.
Sectigo has stopped issuing certificates that include P-521 subscriber keys from CAs that chain to roots in Mozilla's root store.
- A summary of the problematic certificates.
For each problem: number of certs, and the date the first and last certs with that problem were issued.
The first P-521 certificate issued after the policy v2.4 compliance date was issued on March 8th, 2017.
The last such certificate issued was issued on January 2nd, 2019.
237 such certificates were issued in total.
- The complete certificate data for the problematic certificates. The recommended way to provide this is to ensure each certificate is logged to CT and then list the fingerprints or crt.sh IDs, either in the report or as an attached spreadsheet, with one list per distinct problem.
We are working to provide this list and will aim to do so tomorrow, January 10th.
- Explanation about how and why the mistakes were made or bugs introduced, and how they avoided detection until now.
We saw the discussion on m.d.s.p. before the Mozilla Policy change to 2.4 and we saw Gerv propose the updated language on-list.
I suspect we did not follow the link in Gerv's email to the github discussion.
We still managed to miss the crucial piece, i.e. that P-521 had been dropped as an acceptable algorithm.
- List of steps your CA is taking to resolve the situation and ensure such issuance will not be repeated in the future, accompanied with a timeline of when your CA expects to accomplish these things.
We put a code-change live so that no further certificates with P-521 subscriber public keys will be issued.
We previously had an informal process to review Mozilla CA Policy changes.
We have our internal audit team now hooked into monitoring and tracking Mozilla Policy changes.
We are making a new review of our compliance with each item of Mozilla policy, reviewing both current issuance and historic certificate issuance to ensure compliance.
We will report the result of that review in this bug.
Updated•6 years ago
|
Assignee | ||
Comment 4•6 years ago
|
||
- The complete certificate data for the problematic certificates. The recommended way to provide this is to ensure each certificate is logged to CT and then list the fingerprints or crt.sh IDs, either in the report or as an attached spreadsheet, with one list per distinct problem.
6 of the 237 we found are code-signing certificates and so not in scope for Mozilla policy.
The other 231 are:
https://crt.sh/?id=433358283
https://crt.sh/?id=885248041
https://crt.sh/?id=620395705
https://crt.sh/?id=1098875557
https://crt.sh/?id=369709685
https://crt.sh/?id=1098874934
https://crt.sh/?id=441476932
https://crt.sh/?id=1098875684
https://crt.sh/?id=1098874870
https://crt.sh/?id=638345465
https://crt.sh/?id=1098875609
https://crt.sh/?id=1098875611
https://crt.sh/?id=1098874854
https://crt.sh/?id=527107074
https://crt.sh/?id=841848220
https://crt.sh/?id=1098875139
https://crt.sh/?id=538959327
https://crt.sh/?id=1098875616
https://crt.sh/?id=1098875627
https://crt.sh/?id=1098875547
https://crt.sh/?id=638608733
https://crt.sh/?id=1098875432
https://crt.sh/?id=499794005
https://crt.sh/?id=648703097
https://crt.sh/?id=1098875635
https://crt.sh/?id=907036502
https://crt.sh/?id=325088752
https://crt.sh/?id=922823047
https://crt.sh/?id=1098875573
https://crt.sh/?id=1098874843
https://crt.sh/?id=647283833
https://crt.sh/?id=742146772
https://crt.sh/?id=1098875171
https://crt.sh/?id=463185322
https://crt.sh/?id=1098875550
https://crt.sh/?id=1098875566
https://crt.sh/?id=1098875586
https://crt.sh/?id=1098875676
https://crt.sh/?id=1098875561
https://crt.sh/?id=307534525
https://crt.sh/?id=1098875003
https://crt.sh/?id=308201491
https://crt.sh/?id=760522493
https://crt.sh/?id=447484644
https://crt.sh/?id=947873838
https://crt.sh/?id=1098875038
https://crt.sh/?id=505121345
https://crt.sh/?id=1098875442
https://crt.sh/?id=1098874924
https://crt.sh/?id=1098874838
https://crt.sh/?id=1098875562
https://crt.sh/?id=543995312
https://crt.sh/?id=1098875543
https://crt.sh/?id=628400266
https://crt.sh/?id=617047567
https://crt.sh/?id=743367517
https://crt.sh/?id=371552593
https://crt.sh/?id=1098874775
https://crt.sh/?id=1098875583
https://crt.sh/?id=106514798
https://crt.sh/?id=1098875626
https://crt.sh/?id=1098875597
https://crt.sh/?id=1098875642
https://crt.sh/?id=495848274
https://crt.sh/?id=637932875
https://crt.sh/?id=1098875559
https://crt.sh/?id=1098874743
https://crt.sh/?id=960143286
https://crt.sh/?id=970738969
https://crt.sh/?id=998876861
https://crt.sh/?id=1058872928
https://crt.sh/?id=1098875456
https://crt.sh/?id=1098875546
https://crt.sh/?id=1098838903
https://crt.sh/?id=1098874675
https://crt.sh/?id=377999330
https://crt.sh/?id=596168871
https://crt.sh/?id=307606588
https://crt.sh/?id=419685986
https://crt.sh/?id=1098875580
https://crt.sh/?id=887807764
https://crt.sh/?id=1098875210
https://crt.sh/?id=879713746
https://crt.sh/?id=960746353
https://crt.sh/?id=463092619
https://crt.sh/?id=498922249
https://crt.sh/?id=718386742
https://crt.sh/?id=1098875446
https://crt.sh/?id=1098875500
https://crt.sh/?id=597412673
https://crt.sh/?id=615391414
https://crt.sh/?id=1098874856
https://crt.sh/?id=1098875549
https://crt.sh/?id=703034958
https://crt.sh/?id=1098875569
https://crt.sh/?id=642849920
https://crt.sh/?id=592205541
https://crt.sh/?id=1098875578
https://crt.sh/?id=1098875632
https://crt.sh/?id=1098875625
https://crt.sh/?id=292253731
https://crt.sh/?id=539583525
https://crt.sh/?id=433605262
https://crt.sh/?id=1098875582
https://crt.sh/?id=544544159
https://crt.sh/?id=1098874842
https://crt.sh/?id=1098875364
https://crt.sh/?id=1098875619
https://crt.sh/?id=655979734
https://crt.sh/?id=1098874902
https://crt.sh/?id=542849110
https://crt.sh/?id=715244655
https://crt.sh/?id=1098875698
https://crt.sh/?id=620400049
https://crt.sh/?id=307202026
https://crt.sh/?id=1098875595
https://crt.sh/?id=1098875568
https://crt.sh/?id=1098875545
https://crt.sh/?id=1098875623
https://crt.sh/?id=629132167
https://crt.sh/?id=1098875725
https://crt.sh/?id=1098875556
https://crt.sh/?id=513249610
https://crt.sh/?id=1098874850
https://crt.sh/?id=1098875182
https://crt.sh/?id=1098875223
https://crt.sh/?id=363803336
https://crt.sh/?id=975933667
https://crt.sh/?id=1041938710
https://crt.sh/?id=1005868179
https://crt.sh/?id=1098874945
https://crt.sh/?id=1098875618
https://crt.sh/?id=606946466
https://crt.sh/?id=766054468
https://crt.sh/?id=1098875104
https://crt.sh/?id=1098875600
https://crt.sh/?id=703704688
https://crt.sh/?id=1098875544
https://crt.sh/?id=703704444
https://crt.sh/?id=1098875054
https://crt.sh/?id=307656068
https://crt.sh/?id=369824505
https://crt.sh/?id=544551222
https://crt.sh/?id=1098874761
https://crt.sh/?id=885208207
https://crt.sh/?id=1067553966
https://crt.sh/?id=546306627
https://crt.sh/?id=1098875571
https://crt.sh/?id=1098874829
https://crt.sh/?id=492389523
https://crt.sh/?id=849247022
https://crt.sh/?id=1098875548
https://crt.sh/?id=1098875577
https://crt.sh/?id=1098874981
https://crt.sh/?id=308113189
https://crt.sh/?id=455176361
https://crt.sh/?id=1075038661
https://crt.sh/?id=1098875551
https://crt.sh/?id=1020803789
https://crt.sh/?id=1098875310
https://crt.sh/?id=650968319
https://crt.sh/?id=1041982370
https://crt.sh/?id=1098875602
https://crt.sh/?id=1098875238
https://crt.sh/?id=1098875574
https://crt.sh/?id=1098875605
https://crt.sh/?id=502209497
https://crt.sh/?id=1098874770
https://crt.sh/?id=901267132
https://crt.sh/?id=378092112
https://crt.sh/?id=649508017
https://crt.sh/?id=732224783
https://crt.sh/?id=1098875581
https://crt.sh/?id=1098874817
https://crt.sh/?id=1005886673
https://crt.sh/?id=721949738
https://crt.sh/?id=1019943658
https://crt.sh/?id=1098875206
https://crt.sh/?id=1098874919
https://crt.sh/?id=321853040
https://crt.sh/?id=453793685
https://crt.sh/?id=455286814
https://crt.sh/?id=1098875584
https://crt.sh/?id=433114226
https://crt.sh/?id=1098875226
https://crt.sh/?id=1098875041
https://crt.sh/?id=1098875499
https://crt.sh/?id=1098875311
https://crt.sh/?id=1098875558
https://crt.sh/?id=930339745
https://crt.sh/?id=1098875589
https://crt.sh/?id=620131184
https://crt.sh/?id=441178023
https://crt.sh/?id=591996350
https://crt.sh/?id=1098875565
https://crt.sh/?id=1098875575
https://crt.sh/?id=1098875450
https://crt.sh/?id=1098875567
https://crt.sh/?id=1029604684
https://crt.sh/?id=1098875192
https://crt.sh/?id=1098875123
https://crt.sh/?id=591965636
https://crt.sh/?id=524489119
https://crt.sh/?id=1098875540
https://crt.sh/?id=608218571
https://crt.sh/?id=1098875321
https://crt.sh/?id=1098875651
https://crt.sh/?id=1098875624
https://crt.sh/?id=1098874869
https://crt.sh/?id=1067422853
https://crt.sh/?id=1098875610
https://crt.sh/?id=629323969
https://crt.sh/?id=651708880
https://crt.sh/?id=1098875640
https://crt.sh/?id=307650153
https://crt.sh/?id=629128772
https://crt.sh/?id=971777686
https://crt.sh/?id=1060875132
https://crt.sh/?id=1098875576
https://crt.sh/?id=1098875229
https://crt.sh/?id=644866867
https://crt.sh/?id=948285675
https://crt.sh/?id=1098875564
https://crt.sh/?id=1098875604
https://crt.sh/?id=1098874768
https://crt.sh/?id=1098875587
https://crt.sh/?id=1098875591
https://crt.sh/?id=1098875650
https://crt.sh/?id=1098874751
https://crt.sh/?id=1098875082
https://crt.sh/?id=1098875560
Reporter | ||
Updated•6 years ago
|
Reporter | ||
Comment 5•6 years ago
|
||
Thanks for the update, Robin.
We are making a new review of our compliance with each item of Mozilla policy, reviewing both current issuance and historic certificate issuance to ensure compliance.
We will report the result of that review in this bug.
Please report back. I've set the next update to be a week from the last update; please clarify if it will take more time, and if so, when to expect that report.
Assignee | ||
Comment 7•6 years ago
|
||
After a review of our compliance with Mozilla policy[1] we find that although we are substantially in compliance, in addition to the issue identified by the OP where we permitted p521 subscriber keys we have also identified that we had not restricted RSA subscriber keys to have moduli divisible by 8.
We will follow up with analysis of the prevalence of subscriber keys in issued certificates whose RSA moduli are not divisible by 8.
[1] https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
Reporter | ||
Updated•5 years ago
|
Assignee | ||
Comment 9•5 years ago
|
||
We deployed code on 14-March-2019 to prevent the further issuance of certificates with RSA subscriber keys whose modulus size was not divisible by 8.
There is an interim list of the issued serverAuth certificates with such RSA keys provided at https://docs.google.com/spreadsheets/d/13jiciV0BlTNgGtDFDGS-mKZ-XQ_hMSBZRaitwhX-pUM/edit?usp=sharing.
We will refresh this dataset and post another update in the next week.
Reporter | ||
Comment 10•5 years ago
|
||
Robin: It's been over a week since Comment #9. Do you have updates?
Assignee | ||
Comment 11•5 years ago
|
||
Here is a refreshed list of the issued serverAuth certificates with such keys that do not meet Mozilla's policy with regard to the divisibility by eight of the RSA key size.
https://docs.google.com/spreadsheets/d/1yv1tPS-V56DROQkqsqTEbKW4tOeiLCt1D-fsZmoISBc/edit?usp=sharing
Comment 12•5 years ago
|
||
Robin: for the record, can you confirm that Sectigo does not plan to revoke any of these certificates? I do not believe that revocation is required under current Mozilla policy.
Assignee | ||
Comment 13•5 years ago
|
||
Wayne: Sectigo does not plan to revoke any of these certificates.
Assignee | ||
Comment 14•5 years ago
|
||
Corey has just posted to m.d.s.p that we have issued a number of further certificates with P-521 subject keys. We will investigate how we missed these and report back in this bug.
Assignee | ||
Comment 15•5 years ago
|
||
On January 8th, 2019, I said in Comment #2:
"We put a code-change live so that no further certificates with P-521 subscriber public keys will be issued."
We had put a code-change live that would disallow P-521 subscriber public keys in end entity SSL certificates but the code change only fixed one of two code-paths that could lead to the issuance of an SSL certificate.
The code to which a change was made to disallow P-521 was in fact only present in the code branch for creating EV SSL certificates. The limitation on possible public key algorithms and key sizes was implemented completely separately for the non-EV SSL case.
Making the change to only one of the two code paths in which it was required meant that while P-521 keys were correctly disallowed in EV SSL certificates, the non-EV SSL case incorrectly retained support for P-521 keys. Why the difference in mechanisms? – Because the EV Guidelines existed before the Baseline Requirements and so the external policy requirements for supported public key algorithms and key sizes arose at different times.
That suggests that an early contributary factor to this issue happened in 2012 when the code changes to support the (then new) BRs were written. The checks on public key algorithm and key sizes should have been unified across SSL certificates at that time, but they were not.
This also raises the question of how the QA element of our software development process failed to identify this error. The change to implement the restriction on P-521 keys was made as an urgent response to the discovery that we were still issuing end entity certificates with P-521 subscriber public keys against Mozilla’s CA policy in January 2019. This change went through an accelerated development process and the pre-release QA was clearly inadequate. Post release QA was not recorded.
This is the final list of certificates issued by Sectigo after Mozilla’s policy changed to prohibit the use of P-521 subscriber keys:
https://docs.google.com/spreadsheets/d/1n1tjNd3DSGukhsEBLVRBmb1OUov0lS1CHIZkGIPRa6U/edit?usp=sharing
Remediation:
On July 22nd, 2019 we put a further code change live to close off the issuance of end entity TLS certificates containing P-521 subscriber public keys through the second (non-EV) code-path.
Going forward we will increase the level of detail that we record over pre-release QA for code changes and we will consider the detail of pre-release QA during the risk analysis meeting that authorizes each change for release.
We have auditing the completion of post-release QA for recent code changes and will ensure that the completion of post-release QA is recorded for each change released and we will leave development tickets open until post-release QA is recorded as completed.
Comment 16•5 years ago
|
||
It appears that all questions have been answered and remediation is complete.
Assignee | ||
Updated•5 years ago
|
Updated•2 years ago
|
Updated•2 years ago
|
Description
•