Google Revoking Trust In CNNIC Issued Certificates

The New Acunetix V12 Engine


So another digital certificate fiasco, once again involving China from CNNIC (no surprise there) – this time via Egypt. Google is going to remove all CNNIC and EV CAs from their products, probably with the next version of Chrome that gets pushed out.

Google Revoking Trust In CNNIC Issued Certificates

As of yet, no action has been taken by Firefox – or at least no release has been published.

Following the incident in which an Egypt-based company issued unauthorized digital certificates for several Google domains using an intermediate certificate from the China Internet Network Information Center (CNNIC), the search giant has decided to revoke trust in CNNIC certificates.

The change will take effect in a future Chrome release, Google noted on Wednesday in an update made to its initial blog post on the matter.

“As a result of a joint investigation of the events surrounding this incident by Google and CNNIC, we have decided that the CNNIC Root and EV CAs will no longer be recognized in Google products,” said Google security engineer Adam Langley. “To assist customers affected by this decision, for a limited time we will allow CNNIC’s existing certificates to continue to be marked as trusted in Chrome, through the use of a publicly disclosed whitelist.”

The incident came to light last week, when Google revealed that several unauthorized certificates had been issued by Egypt-based MCS Holdings and installed on an internal firewall device that acted as a man-in-the-middle (MitM) proxy.

CNNIC revoked the intermediate certificate used by MCS Holdings and pointed out that the Egyptian firm should have used it to issue only certificates for domains it had registered.


Proper certs being used for MITM attacks, pretty dodgy indeed. Especially when CNNIC is included in all major root stores this does constitute a fairly serious breach of the Certificate Authority system.

I’m pretty sure CNNIC will be ‘let back in’ at some point, meaning their certs will be reissued and reinstated, but for now – they are OUT!

CNNIC’s certificates are included in all major root stores and Google believes this was a “serious breach of the CA system.” After being alerted by Google, both Mozilla and Microsoft took steps to protect Firefox and Internet Explorer users.

Langley said that while there is no evidence to suggest that other fake certificates have been issued or that the ones from MCS Holdings were used outside of the company’s own network, CNNIC will have to take measures before it can earn Google’s trust again.

“CNNIC will implement Certificate Transparency for all of their certificates prior to any request for reinclusion. We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place,” Langley said.

In a brief statement issued on Thursday, CNNIC urged Google to reconsider its decision.

“The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration,” CNNIC stated. “For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected.”

Mozilla could also take action against CNNIC, but the company is still discussing options with members of its community.

You can read the full post from Google here: Maintaining digital certificate security

And the statement from CNNIC here: Declaration

Source: Security Week

Posted in: Cryptography, Privacy

, , , ,


Latest Posts:


testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.


One Response to Google Revoking Trust In CNNIC Issued Certificates

  1. Alex L April 4, 2015 at 6:52 am #

    Mozilla is following suit and distrusting CNNIC certs – https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/

    Personally, I’m glad to see the big browsers taking this seriously