Re:Certificate Authorities and the Fragility of Internet Safety
by Nursie on Wednesday December 04, 2024 @11:23PM
(#42324948)
So the ICP Brazil thing is interesting.
It's not a certificate intended for use on the web in general. It's an open finance certificate designed for use within that ecosystem within Brazil, and it was issued to a google subsidiary who would have requested it to have that common name, and who would have been evaluated as being authorised to have such a certificate within that context.
The main problem seems to be that the root certificate was in the MS keystores, and seems to have previously been submitted to mozilla (and maybe others) for inclusion, which points to a poor separation of concerns for that CA. They clearly wanted to be a general web authority at some point, but were repurposed.
So it's hard to see it as purely a "misissuance", and it's definitely not malicious.
It's not a certificate intended for use on the web in general. It's an open finance certificate designed for use within that ecosystem within Brazil, and it was issued to a google subsidiary who would have requested it to have that common name, and who would have been evaluated as being authorised to have such a certificate within that context.
The main problem seems to be that the root certificate was in the MS keystores, and seems to have previously been submitted to mozilla (and maybe others) for inclusion, which points to a poor separation of concerns for that CA. They clearly wanted to be a general web authority at some point, but were repurposed.
So it's hard to see it as purely a "misissuance", and it's definitely not malicious.