Symantec Subsidiary Thawte Issues Rogue Google Certificates

New submitter jack_babylon writes: On September 14th, Symantec's subsidiary certificate authority Thawte accidentally released a "small number" of " "inappropriately issued" security certificates, apparently intended for internal testing only. However, the fact that these were logged in the wild by Google (and, apparently, DigiCert) seems to indicate that they escaped the lab, at least far enough for a false google.com cert to raise the appropriate red flags. This sounds similar to the recent acts of poor judgement that got CNNIC's certs removed entirely from Firefox and Chrome, if more limited in scope and more quickly addressed (through, among other things, termination of some Symantec employees). (And like all reports one hopes go away quietly, these were released in the dead of a Friday night — h/t BoingBoing for noting this news.)

Comments

Re:How is this possible?

[whoever57]

Not the GP poster, but here goes:

The ideal situation is that the Certificate owner generates a signing request and has that signed, so the original key does not go outside the certificate owner.

However, there is nothing in the current setup to prevent a certificate authority from generating a request in the name of any domain and signing it. That's what appears to have happened here.

The real question is 'why?'. The explanation ("testing") doesn't pass muster. Someone would have to deploy these certificates on a service that was either a Google property or was masquerading for a Google property. Does Google outsource the deployment of certificates? I would doubt this very much, which suggests that this wasn't so much an accident as the influence of a TLA.