18

From this blog.

Intermediate CAs are certificates signed by a root CA that can sign arbitrary certificates for any websites.

They are just as powerful as root CAs, but there's no full list of the ones your system trusts, because root CAs can make new ones at will, and your system will trust them at first sight. There are THOUSANDS logged in CT.

This month an interesting one popped up, generated apparently in September 2015: "Blue Coat Public Services Intermediate CA", signed by Symantec. (No certificates signed by this CA have reached the CT logs or Censys so far.)

I thought it would be a good occasion to write up how to explicitly untrust an intermediate CA that would otherwise be trusted in OS X. It won't stop the root CA from handing a new intermediate to the same organization, but better than nothing.

When I tried the steps in the blog in Ubuntu, I download this certificate https://crt.sh/?id=19538258. When I open the .crt it imports into the Gnome Keyring, but then I couldn't find a way to "untrust" the certificate after importing it.

8
+100

Just to make things difficult, Linux has more than one library for working with certificates.

If you're using Mozilla's NSS, you can Actively Distrust (their terminology) a certificate using certutil's -t trustargs option:

$ certutil -d <path to directory containing database> -M -t p -n "Blue Coat Public Services Intermediate CA"

For Firefox, <path to directory containing database> is usually ~/.mozilla/firefox/<???>.profile where <???> are some random looking characters. (certutil is eg. in ubuntu's libnss3-tools package)

The breakdown is as follows:

-M to modify the database

-t p to set the trust to Prohibited

-n to carry out the operation on the named certificate

Even within NSS, not all applications share the same database; so you may have to repeat this process. For example, to do the same for Chrome, change the -d <path> to -d sql:.pki/nssdb/.

$ certutil -d sql:.pki/nssdb/ -M -t p -n "Blue Coat Public Services Intermediate CA"

However, not all applications use NSS, so this isn't a complete solution. For example, I don't believe it's possible to do this with the OpenSSL library.

As a consequence, any application that uses OpenSSL to provide it's certificate chain building (TLS, IPSec etc) would trust a chain with a Blue Coat certificate and there is nothing that you can do about it short of removing the Root CA that signed it from your trust anchor store (which would be silly considering it's a Symantec Root CA as you'd end up distrusting half the Internet), whereas applications that rely on NSS can be configured more granular to distrust any chain that has the Blue Coat certificate within it.

For example, I believe OpenVPN uses OpenSSL as it's library for certificates, therefore big brother could be listening to your OpenVPN traffic without your knowledge if you are connecting to a commercial VPN provider which uses OpenVPN. If you are really concerned about that then check who your commercial VPN provider's Root CA is - if it's Symantec/Verisign then maybe it's time to ditch them for someone else?

Note that SSH doesn't use X509 certificates therefore you can connect and tunnel using SSH without worrying about Blue Coat MITM attacks.

  • I updated the question to indicate that when I double clicked on the cert it was imported into the gnome keyring. I did manage to find a way to import it into Firefox in my answer below. – raphael May 27 '16 at 20:16
  • For OpenSSL wouldn't just removing the cert be the same as untrusting it? It can only validate certs it knows about after all. – Bratchley May 27 '16 at 20:45
  • 1
    @Bratchley - What if the suspect certificate was sent (as it should be) as part of the TLS handshake? It would simply be trusted, unless there's a way (as there is with Mozilla NSS, Windows & OS-X) to insist that's it is always untrusted. – garethTheRed May 30 '16 at 19:13
  • @garethTheRed I might be missing something, but if the library requires the cert to be validated then wouldn't either doing a CRL or removing the trusted root CA resolve the issue? Whether it's client or server certs, it should still require validation. – Bratchley May 31 '16 at 12:14
  • 1
    Yes. Bluecoat were issued a CA certificate by Verisign for use in man-in-the-middle devices. The OP asks how to distrust this certificate. So this is about distrusting a subordinate certificate that the superior issuing CA (Root in this case) won't revoke, when, like you say, you don't want to un-trust the root (Verisign). – garethTheRed May 31 '16 at 12:44
0

I can't comment yet, so I'll have to comment here that on Ubuntu Gnome 15.10, when I use @garethTheRed's approach, I get:

~$ certutil -d ~/.mozilla/firefox/<directory>.default -M -t p -n "Blue Coat Public Services Intermediate CA" 
certutil: could not find certificate named "Blue Coat Public Services Intermediate CA": SEC_ERROR_BAD_DATABASE: security library: bad database.

~$ certutil -d sql:.pki/nssdb/ -M -t p -n "Blue Coat Public Services Intermediate CA"
certutil: could not find certificate named "Blue Coat Public Services Intermediate CA": SEC_ERROR_UNRECOGNIZED_OID: Unrecognized Object Identifier.

"Blue Coat Systems, Inc." doesn't work, either.

(This is the certificate I imported: https://crt.sh/?id=19538258)

  • Did you download and import the certificate first? – raphael May 27 '16 at 14:56
  • Yes, I imported this one: crt.sh/?id=19538258. (Seems I can comment now! :) – Diagon May 27 '16 at 15:33
  • I think you can only comment on your own answer. I haven't actually tried the procedure yet. – raphael May 27 '16 at 16:29
  • see my answer below – raphael May 27 '16 at 20:16
  • @raphael - I tried to edit below, letting you know that: While the link above describes "-t p" as "prohibited (explicitly distrusted)", the Ubuntu 15.10 man page describes it as "p - Valid peer". I hope you didn't do the wrong thing. – Diagon May 27 '16 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.