Chapter 9iii: Certificate Issuance

Question 1

Certificate Issuance

Explain 3 ways in which a certificate is issued in practice.

Answer 1

• Domain Validation (DV): proves ownership of the domain
• Extended Validation (EV): Additionally requires (strong) legal documentation of the claimed identity
• Organizational Validation (rare): Between DV and EV; less documentation

Question 2

Certificate Issuance How to get a Certificate?

Standard approach of domain validation:

• …
• …
• Log into the CA’s awesome web interface
  *…
• Verify domain with one of many vendor-specific verification methods (Mail to ca-admin@domain, http- Textfile, TXT DNS record, …)
• Pay some sum of money
• …

Answer 2

Generate RSA key
Generate Certificate Signing Request (CSR)
Fill out the ordering form, upload CSR
Receive and install the certificate

Question 3

Certificate Issuance

Kurt Seifried vs. RapidSSL

What’s the main failure here?

Answer 3

• CAs use a couple of ‘protected’ addresses for domain validation
• In case of portugalmail.pt, these addresses were not protected…
• Who ever controls these addresses, can request certificates for this domain
• This issue is now in Mozilla’s ‘Problematic practices’

Question 4

Certificate Issuance Economics and security

• Incentive to lower prices →…
• Actually not true! Results of a study (2013): explain.
• This shows customers behave rationally correct, but different from what designers of security system would have expected

Answer 4

less checks, makes certification cheaper

• Empirical (quantitative) part: the more expensive CAs have more customers
• Quantitative part: in interviews, customers say they prefer a CA that is ‘too big to fail’ and will never be removed
  from root stores
• Indeed, large CAs are difficult to remove from root stores as the Web browser would suddenly show errors for
  many sites!

Question 5

How does the certificate issuance process work?

Answer 5

Question 6

Certificate Issuance HTTP-01 Challenge Request

Answer 6

Question 7

Certificate Issuance

HTTP-01 Challenge Verification

Answer 7

Question 8

Certificate Issuance

DNS-01 Challenge Verification

Answer 8

Question 9

Certificate Issuance ACME Certificate Creation

• Authorized account key pair can …
• Certificate Signing Request (CSR) (RFC2986) is …
• CSR is signed by ….
• Account key also signs …

Answer 9

request, renew and revoke certificates for the domain by signing messages
created for desired domains
private key of the public key that’s also in the CSR
whole certificate request with its private key

Question 10

Certificate Issuance: ACME Certificate Revocation

When a certificate shall be revoked, …

The revocation is processed by the…

Answer 10

sign the revocation request with the authorized key pair!

CA and distributed to clients.

see slide 52-55 for some more about these.