please remove trust of GPKIRootCA1 root certificate or sub-ca
Reported by
hg5...@gmail.com,
Mar 20 2018
|
|||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36 Steps to reproduce the problem: 1. visit https://www.gpki.go.kr sub-CA : CA131100001 2. visit https://www.epki.go.kr sub-CA : CA134100031 What is the expected behavior? must raise a INVAILD ROOT certifcate error. What went wrong? Root CA : https://crt.sh/?caid=122 CA131100001 : https://crt.sh/?caid=272 being run by http://www.gpki.go.kr list of certificate : https://crt.sh/?icaid=272&identity=%25 CA134100031 : https://crt.sh/?caid=123 being run by http://www.epki.go.kr list of certificate : https://crt.sh/?icaid=123&identity=%25 1. certificate issued by sub CA CA131100001 does not provide valid OCSP response for a long time. 2. certificate issued by sub CA CA134100031 does not issued with HTTP CRL endpoint and OCSP HTTP endpoint. Did this work before? N/A Chrome version: 65.0.3325.162 Channel: stable OS Version: 10.0 Flash Version:
,
Mar 20 2018
intermeidate certificate have a invalid CRL endpoint. which is violation of CA/B Baseline Requirements.
,
Mar 20 2018
,
Mar 20 2018
,
Mar 21 2018
CA131100001/CA131100002 Webtrust audit https://cert.webtrust.org/ViewSeal?id=2183 https://cert.webtrust.org/ViewSeal?id=2184 CA134100031 Webtrust audit https://cert.webtrust.org/ViewSeal?id=2259 https://cert.webtrust.org/ViewSeal?id=2030
,
Mar 21 2018
You can disable trust in a root certificate at https://www.thesslstore.com/blog/how-to-remove-a-root-certificate/ You can also contact Microsoft Root Program Management at msroot@microsoft.com to report non-compliance, as detailed at https://aka.ms/rootcert
,
Mar 21 2018
i send report to microsoft. because they trust CNNIC Root yet, i guess microsoft won't consider my report.
,
Mar 21 2018
CA134100031 Webtrust audit(most recent) https://cert.webtrust.org/ViewSeal?id=2260 https://cert.webtrust.org/ViewSeal?id=2259 i think the most problem is there is no way to check if certificate is revoked
,
Mar 21 2018
rogue Certificates. it seems like they are not verifing domain ownership for ssl certificate. www.testssl.com https://crt.sh/?id=287853939 www.ssltest.com https://crt.sh/?id=34729314 test_btms.seoul.go.kr https://crt.sh/?id=290064037 test.*.pen.go.kr https://crt.sh/?id=282476214 test123.go.kr https://crt.sh/?id=287836356 *.test.co.kr https://crt.sh/?id=287836632 arasun.test.co.kr https://crt.sh/?id=287314507 www.test1111.co.kr https://crt.sh/?id=287836414 www.*.posan.ms.kr https://crt.sh/?id=39299279 e-csinfo.*.go.kr https://crt.sh/?id=100365037
,
Mar 22 2018
This issue seems to be out of TE scope as this is related to GPKIRootCA1 root certificate. Hence adding TE-NeedsTriageHelp label. Could someone from dev team please have a look at this issue. Thanks!
,
Mar 22 2018
found more rouge certificates 210.178.100.164 https://crt.sh/?id=25317212 27.101.205.4 https://crt.sh/?id=284354323 61.108.124.4 https://crt.sh/?id=22520376 210.179.139.131 https://crt.sh/?id=16222145 27.101.119.206 https://crt.sh/?id=284281642 DNS:urk (invaild domain) https://crt.sh/?id=69934958 DNS:eais (invaild domain) https://crt.sh/?id=26288690 DNS:chs.cdc (non existent domain) DNS:go.kr (TLD) ( https://en.wikipedia.org/wiki/.kr ) https://crt.sh/?id=6817233
,
Mar 22 2018
many ip address certificates https://crt.sh/?icaid=123&dnsname=%25.___.___.%25 certificate for commonName "real." https://crt.sh/?id=30277284 DNS:cert.ust (non existent domain) DNS:ac.kr (TLD) https://crt.sh/?id=35679516 multiple common name *.ssem.or.kr *.serii.re.kr *.kkulbaksa.com https://crt.sh/?id=275519841
,
Mar 22 2018
TLD wildcard certificate which is in public suffix list. as GPKI is run by Korea Goverment, this can be used for MITM by Goverment. https://publicsuffix.org/list/ DNS:*.sc.kr DNS:*.or.kr DNS:*.kg.kr DNS:*.hs.kr DNS:*.ms.kr DNS:*.es.kr https://crt.sh/?id=216514419 DNS:*.kg.kr DNS:*.es.kr DNS:*.hs.kr DNS:*.ms.k https://crt.sh/?id=169761218 DNS:*.go.kr DNS:*.or.kr DNS:*.sc.kr DNS:*.kg.kr DNS:*.hs.kr DNS:*.ms.kr DNS:*.es.kr https://crt.sh/?id=140593669 DNS:*.sc.kr https://crt.sh/?id=107698017 DNS:*.or.kr DNS:*.kg.kr DNS:*.sc.kr DNS:*.hs.kr DNS:*.ms.kr DNS:*.es.kr https://crt.sh/?id=93537384 DNS:*.sc.kr DNS:*.hs.kr DNS:*.ms.kr DNS:*.es.kr https://crt.sh/?id=61150414 DNS:*.kg.kr DNS:*.es.kr https://crt.sh/?id=61136851 DNS:*.or.kr DNS:*.kg.kr DNS:*.sc.kr DNS:*.hs.kr DNS:*.ms.kr DNS:*.es.kr https://crt.sh/?id=20687119 more wildcard certs on here : https://crt.sh/?icaid=123&dnsname=*.__.__
,
Mar 22 2018
DNS:*.co.kr (which affect more than 600,000+ TLD) but all expired certificate https://crt.sh/?id=8169164 https://crt.sh/?id=6990343 https://crt.sh/?id=6797278
,
Mar 22 2018
affected domain statistics https://isis.kisa.or.kr/statistics/?pageId=010102
,
Mar 22 2018
the real problem is there is no way to revoke the misissued certificate.
,
Mar 25 2018
https://docs.google.com/spreadsheets/d/1gsaZcvLY0vwe2humZn_3E3y89huqjPyS_syTHQCqy1Q/edit?usp=sharing
,
Mar 29 2018
CA131100001, CA131100002 is used by Ministry of the Interior and Safety (South Korea) https://en.wikipedia.org/wiki/Ministry_of_the_Interior_and_Safety_(South_Korea) CA134100031 is used by Ministry of Education (South Korea) https://en.wikipedia.org/wiki/Ministry_of_Education_(South_Korea) CA974000031 which is used by Supreme Court of Korea https://crt.sh/?id=3526559 7.1.2.2.b cRLDistributionPoints This extension MUST be present and MUST NOT be marked critical. It MUST contain the HTTP URL of the CA’s CRL service. => does not have cRLDistributionPoints with HTTP URL EndPoint 7.1.2.2.c authorityInformationAccess => does not have a OCSP endpoint. leaf certificate of CA974000031 https://crt.sh/?icaid=1457&identity=% CA/B BR 7.1.2.3.b cRLDistributionPoints This extension MUST be present and MUST NOT be marked critical. It MUST contain the HTTP URL of the CA’s CRL service. => does not have cRLDistributionPoints with HTTP URL EndPoint 7.1.2.3.c authorityInformationAccess => does not have a OCSP endpoint CA974000031 and CA134100031 does not have a ability to revoke the certificate
,
Apr 4 2018
https://crt.sh/?id=274586180 www.서울신천병설유치원.com https://crt.sh/?id=284588956 gscst2@snu.ac.kr https://crt.sh/?id=71279275 gimhaeeast.gnfire.go.kr https://crt.sh/?id=26756806 "gihoo.damyang.go.kr/index.damyang museum.damyang.go.kr/museum" https://crt.sh/?id=19158231 cm.korea.ac.kr` https://crt.sh/?id=9709628 www.서울신천병설유치원.com https://crt.sh/?id=7489831 친환경농업센터.kr https://crt.sh/?id=5663123 hc-lib.or.kr/ https://crt.sh/?id=9923100 www.bukbu-lib.daegu.kr/ https://crt.sh/?id=6015582 pcsec.sje.go.kr/ https://crt.sh/?id=6010752 180.80.31.225/
,
Apr 4 2018
,
Apr 4 2018
Issued to *.or.kr certificates: https://crt.sh/?id=140593669 https://crt.sh/?id=216514419 https://crt.sh/?id=93537384 https://crt.sh/?id=20687119
,
Apr 4 2018
Issued with no OCSP data: https://crt.sh/?id=6990343
,
Apr 4 2018
It should be untrusted, *.co.kr can MITM google.co.kr. They are expried but Goverment of Korea can issue anytime while this certificate not untrusted.
,
Apr 5 2018
Issued to Internal IP. https://crt.sh/?id=284348972
,
Apr 5 2018
Before adding crt.sh url. Plesae see xlsx file in comment 22 https://bugs.chromium.org/p/chromium/issues/detail?id=823665#c22
,
Apr 5 2018
Edit: Comment 31, the * .co.kr certificate itself will not work, but recently there was a saying in Korea that ISPs were intercepting HTTPS (to block harmful sites). As a result, it is quite probable that Goverment of Korea will intercept gmail.com or google.co.kr through GPKIRootCA1.
,
Apr 5 2018
29 certificate with RSA key size < 2048 which is violation of CA/B Forum BR " 2013-12-31 6.1.5 CAs SHALL confirm that the RSA Public Key is at least 2048 bits or that one of the following ECC curves is used: P-256, P-384, or P-521. A Root CA Certificate issued prior to 31 Dec. 2010 with an RSA key size less than 2048bits MAY still serve as a trust anchor."
,
Apr 5 2018
480 certificate with multiple CommonName(NOT SAN) ex) https://crt.sh/?id=372265569
,
Apr 6 2018
100365037 Revoked by CRL. but only 100365037.
,
Apr 6 2018
Regarding Comment #9: The "GPKIRootCA1" is included in Microsoft's trusted CA list, as it was issued by "government". This issue was discussed already in year 2013 [1]. I doubt that Microsoft will remove this certificate unless there is a significant public pressure, implied in this comment by one of Microsoft's moderator at [1]: > Although they are not verified by third party through WebTrust, we can't assume that a mere lack of third party audit of KISA through WebTrust does not imply that KISA as a topmost CA should not be trusted and insecure, since they acquired their trust as a CA by government internal auditing policy. > We also found that KISA decided to perform third-party audit in order to gain WebTrust certification as a root CA, as announced in their press release in September 2013. > This topic is not appropriate to deeply discuss in Microsoft Community, please make an inquiry to KISA for more information. (translated from Korean original text) While KISA, MOI and MOE got a WebTrust seal afterwards, third-party audit (also the WebTrust seal itself) should be questioned due to uncaught multiple violations discussed in this bug report and also [2]. Chromium's Root Certificate Policy states "Google Chrome reserves the right to distrust root certificates present in the operating system's root certificate list." This is the just moment to exercise the right. [1] https://answers.microsoft.com/ko-kr/ie/forum/ie11-windows_7/%EC%A0%9C3%EC%9E%90/a166a80c-e8d5-413b-8c8b-6567b92b3a7c?auth=1 (in Korean) [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1451235
,
Apr 7 2018
another issue Distrust the WebTrust Audit of EY (HanYoung) South Korea and KPMG (Samjong) South Korea. https://bugzilla.mozilla.org/show_bug.cgi?id=1451578
,
Apr 7 2018
GPKI Says: will revoke any wrong certificate to yesterday(UTC+9) (Ref. http://www.boannews.com/media/view.asp?idx=68221)
,
Apr 7 2018
some Certificate can't be revoked, because they don't have proper CRL or OCSP EndPoint. the only way to revoke the certificate is revoke the Sub-CA or Root Certificate. Or use the Google Chrome CRL Sets https://dev.chromium.org/Home/chromium-security/crlsets
,
Apr 7 2018
,
Apr 7 2018
Edit Comment #44 : as MS Edge and IE does not use CRLset, the only way to revoke the certificate is revoke the intermediate certificate
,
Apr 7 2018
>Edit Comment #44 : as MS Edge and IE does not use CRLset, the only way to revoke the certificate is revoke the intermediate certificate This site is bugs.chromium.org, dedicated for Chromium, as such MS Edge and IE business is (IMO) out of scope for this bug.
,
Apr 7 2018
This issue opened as a blink-dev request 4/7 here Request to Deprecate and Remove: Trust in existing Korean GPKI certificates by ylemkimon https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/ujIKn9HUCF4
,
Apr 8 2018
Yes, cannot revoke. this CA should untrusted.
,
Apr 9 2018
MOE(CA134100031) Reported: Any wrong certificate was revoked. but some certificate are not revoked(even can be revoked). Other Sub Certificate Authorities are did not anything.
,
Apr 9 2018
Delete comment ⚐ EPKI CA Still issues Certificate without Domain Control Validation. thought No One registered for domain "jbedu9.kr", EPKI issued certificate for that domain at 2018-Apr-06 https://crt.sh/?id=385108875 .kr whois : https://whois.kisa.or.kr/eng/main.jsp
,
Apr 10 2018
,
Apr 28 2018
https://crt.sh/?icaid=1457&identity=%25 https://crt.sh/?caid=1457&minNotBefore=20100101&opt=cablint,x509lint,zlint Supreme court of Korea CA which is subCA of GPKIRootCA1 issued none BR compliant SSL certificate. GPKIRootCA1 must have a responsibility for this incident.
,
Jun 11 2018
i send request to MOI( who operate GPKI Root CA1 and CA131100001) to remove trust of EPKI intermediate Root CA134100031 on 2018-04-27. but they officially answered to my request that "MOI will not remove trust theCA134100031". i attached original document and translated english. Here is list of man in charge of this incident. 한 창윤(CHANGYUN HAN) a man who is in charge of GPKI Root CA. a man who officially answerd my question. tel : +82-2-2100-3990 ref : http://www.mois.go.kr/frt/a07/searchStaff.do?selectedTeamId=1741379&orgnzt_id=1741379&mgrDetailFlag=Y 김 형욱(Hyunwook Kim) bugzilla : https://bugzilla.mozilla.org/user_profile?user_id=588247 https://bugzilla.mozilla.org/show_bug.cgi?id=1377389 email : hyunwookkim@klid.or.kr tel : +82-2-2031-9831 a man who in charge of technicall part of operating GPKI Root CA1 ref : http://www.klid.or.kr/section/organization/org_info.html?PID=organization1&select_org=16
,
Jun 11 2018
still, they are issuing None-BR-Compliance SSL Certificates. "BR certificates should include an HTTP URL of the issuing CA's certificate" https://crt.sh/?caid=272&minNotBefore=20180101&opt=cablint https://crt.sh/?caid=123&minNotBefore=20180101&opt=cablint |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by hg5...@gmail.com
, Mar 20 2018