Re:CNNIC's response to Google
by jtokoph on Thursday April 02, 2015 @01:54AM
(#9308891)
I find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as valid: http://i.imgur.com/fTzxpBh.png
[ Parent
| on HN ]
Google is explicitly whitelisting the legitimate end-user certificates CNNIC has issued, and then revoking the root.
Basically they had to hand over a list of all issued certificates, Google reviewed them, and CNNIC can't issue any new ones without asking Google to whitelist it.
Related to their use of SHA1 on the certificate: http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...
Yup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.)
If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.