New issue
Advanced search Search tips

Issue 597241 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Mar 2016
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Don't use common certificate storage

Reported by abys...@gmail.com, Mar 23 2016 
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

Steps to reproduce the problem:
Currently the Chromium and (by default) all Chromium-based browsers use the same storage for user-provided certificates. Consider the following scenario. I work in an enterprise network with it's own CA. This CA issues self-signed certificates for internal resources. If I want to visit them, I have to insert the CA root-certificate into Chrome (or Chromium-based browser). But I don't want this certificate to be valid for any other resource outside of a local network - to prevent possible MiTM by our admins.

What is the expected behavior?
Root certificates are valid per domain or per Chrome user or at least per browser installation.

What went wrong?
Root certificates are used for all users and all Chromium-based browsers (if they don't explicitly change this part in the source code).

Did this work before? No 

Chrome version: 49.0.2623.87  Channel: stable
OS Version: Fedora 23
Flash Version: Shockwave Flash 21.0 r0

Comment 1 by wfh@chromium.org, Mar 23 2016

Labels: -Restrict-View-SecurityTeam
Status: WontFix (was: Unconfirmed)
it is possible to scope a root certificate to only be valid for a set of domains by using Name Constraints. Chromium will respect these name constraints.

I suggest you contact your administrator and ask them to add a name constraint to their MITM certificate.

Chromium using the system certificate store is a conscious design decision and is working as intended.
Project Member

Comment 2 by sheriffbot@chromium.org, Oct 1 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 2 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 4 by mbarbe...@chromium.org, Oct 2 2016

Labels: allpublic
►

Sign in to add a comment