1572287 - Add attacker-controlled google.tg certificates to OneCRL

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Wayne Thayer]

Attachment: google.tg.crt

The following (and attached) certificate has been reported as misissued and should be added to OneCRL: https://crt.sh/?id=1743697773

This appears to be a .tg ccTLD compromise related to 1414039 and https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/4kj8Jeem0EU/Lmvw98EqBgAJ

Comment 1

[Kathleen Wilson]

Ryan, Are you point from Google on this? If yes, any further mis-issued *.tg certs identified?
I recall that last time the *.tg registry was compromised it was for a period of time and affected multiple CAs.

Comment 2

[Ryan Sleevi]

I haven’t done any deep dives for any other sites yet, but I expect it’s going to be a similar story.

Comment 3

[Kathleen Wilson]

Adding the issuing CA for the currently known cert, so they can provide their findings, especially if additional certs should be added to OneCRL.

Comment 4

[Rob Stradling]

s/misissued/attacker-controlled/, to use the same language as bug 1414039. Sectigo/cPanel did not misissue this certificate. The BRs and Mozilla Root Store Policy only require CAs to prove domain control, not ownership. Before issuing this certificate, Sectigo validated domain control and encountered an empty CAA RRset.

Comment 5

[Kathleen Wilson]

Rob, Is Sectigo going to revoke this cert? Has Sectigo reached out to *.tg registry to see if they are having a problem?

Comment 6

[Wayne Thayer]

Rob - thank you for confirming that this is not a misissuance. I would also like to know if Sectigo has checked to see if any other questionable .tg certs were issued recently.

Comment 7

[Robin Alden]

Kathleen,
We have revoked https://crt.sh/?id=1743697773

We have reached out to the .tg registry using the contact details from https://www.iana.org/domains/root/db/tg.html, we do not yet have any information to report.

Wayne,
We have checked, but are continuing to check further.
I have prepared a list of all the .tg domains that we included in TLS certificates from 01-August to date. It is here:
https://docs.google.com/spreadsheets/d/1oE8FkZImbhgwuKwvTaX0t8v-ITxztZQ5s3xmpO5PR34/edit?usp=sharing

The amazon.tg certificate looks questionable, and we have reached out to Trev @ Amazon who will check whether it was ordered by them. Jonathan Rudenberg also kindly alerted us specifically to the Amazon.tg certificate.

A ramco.tg certificate also looks questionable, as it shares a pattern with the above two. Ramco.com is a global payroll firm, whereas Ramco.tg appears to be a supermarket chain in Togo.

Comment 8

[Robin Alden]

The Amazon security team responded to our enquiry and we have revoked the amazon.tg certificate.

Comment 9

[Wayne Thayer]

Attachment: amazon.tg.crt

We'll also add the attached amazon.tg cert to OneCRL.

Comment 10

[Wayne Thayer]

These two certificates are now in OneCRL