Changes

Jump to: navigation, search

CA/Symantec Issues

2,842 bytes added, 08:32, 30 March 2017
Yet more work
==Issue XXX: Audit Issues For Symantec Itself (December 2014 - November 2015)==
The All of Symantec's current audit reports can be found in their [https://www.symantec.com/content/en/us/about/medialegal/repository/GeoTrust-WTBR-2015.pdf most recent available auditjsp legal repository] for . I don't believe they provide links to historic versions. Symantec's GeoTrust roots runs standard audit period is from December 1st, 2014 to November 30th, 201531st. The newer one should We would therefore expect their 2016 audit to be available by now, but seems to have been delayed. On pages 2-5 of that However Symantec regularly only supplies their audit, the management assertions (and thereby the auditors) call out the following violations of reports more than 180 days after the audit has been completed. The Baseline Requirements section 8.6 says that CAs SHOULD provide them in 90 days or Network Security Guidelines:fewer. Symantec is not the only CA which regularly supplies its audits late.
The most recent available Baseline Requirements audits for Symantec's [https://www.symantec.com/content/en/us/about/media/repository/GeoTrust-WTBR-2015.pdf GeoTrust roots] and their [https://www.symantec.com/content/en/us/about/media/repository/Symantec-Thawte-WTBR-2015.pdf Symantec and Thawte roots] run from December 1st, 2014 to November 30th, 2015. In those audits, the management assertions (and thereby the auditors) call out the following violations of the Baseline Requirements or Network Security Guidelines: # Issuance of Internal Server Namespast the deadline date
# Test certificates issued for domains Symantec did not own or control (see above)
# No audit report, or invalid audit report, obtained for 3 of 5 external partner sub-CAs(GeoTrust only)
# Failure to maintain physical security records for an appropriate period of time
# Unauthorized employees with access to certificate issuance capability
# Failure to review application and system logs
The nost recent available WebTrust for CAs audits for Symantec's [https://www.symantec.com/content/en/us/about/media/repository/Symantec-STN-WTCA-2015.pdf most recent available audit] for Symantec's Verisign and own-brand roots runs ], their [https://www.symantec.com/content/en/us/about/media/repository/Thawte-WTCA-2015.pdf Thawte roots] and their [https://www.symantec.com/content/en/us/about/media/repository/GeoTrust-WTCA-2015.pdf GeoTrust roots] run from December 1st, 2014 to November 30th, 2015. The newer one should be available by now, but seems to have been delayed. On pages 2-3 of that auditIn those audits, the management assertions (and thereby the auditors) call out the following violations of the Baseline Requirements or Network Security Guidelines:
# Background checks not renewed for trusted personnel
# Unauthorized employees with access to certificate issuance capability
# Failure to maintain physical security records for an appropriate period of time(GeoTrust only)
# Test certificates issued for domains Symantec did not own or control (see above)
 
Of these, only the 'background checks' issue is not a repeat of an issue raised in the BR audits.
 
The most-recently available Extended Validation audits for Symantec's [https://www.symantec.com/content/en/us/about/media/repository/Symantec-STN-WTEV-2015.pdf Verisign and own-brand roots], their [https://www.symantec.com/content/en/us/about/media/repository/Thawte-WTEV-2015.pdf Thawte roots] and their [https://www.symantec.com/content/en/us/about/media/repository/GeoTrust-WTEV-2015.pdf GeoTrust roots] run from December 1st, 2014 to November 30th, 2015. In those audits, the management assertions (and thereby the auditors) call out the 'test certificates' and the 'physical security records' issues which are noted above.
===Symantec Response===
XXXComment from KathleenEach of the documents contains, in a following table, Symantec's comments on the qualifications and what they have done or are doing to remedy them.  Mozilla did not object to these qualifications in Symantec's audits at the time the audit documentation was submitted to us. Because of this, it is not reasonable for us to take action based on the mere existence of these qualifications. They are listed here because they are one part of the general picture of Symantec's compliance or otherwise with the BRs.
==Issue XXX: SHA-1 Issuance After Deadline (January 2016)==
* Violation of CPS (use of non-KR country code)
Some of these misissuance were caused by employees of the RA CrossCert overriding compliance flags in Symantec's issuance system. Symantec had no process in place to review the logs of overridden flags. For some of the certs, they contained domains neither Symantec nor CrossCert own or control, and CrossCert did not complete the appropriate domain validations for them.
This incident is recorded in {{bug|1334377}}.
===Symantec Response===
Due to Symantec made a number of comments on this issue - [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831038 0], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831933 1], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831933 2], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8838825 3], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8843448 4]. The Baseline Requirements, in section 4.9.1.1 item 9, state that the CA SHALL revoke a certificate if "The CA is made aware that the Certificate was not issued in accordance with these discoveriesRequirements or the CA’s Certificate Poliy or Certification Practice Statement". However, Symantec did not revoke all the certificates. Instead, Symantec subsequently decided to shut down the RA program entirely and re-assess every certificate issued under it. Upon taking this decision, Symantec committed to revalidating all 30of the CrossCert-issued certificates (10,000+) and any of the 20,000+ certificates issued by their other RAs if deficient validation was discovered. However, the determination of deficient validation was made based on the RAs own logs of activity, which may themselves be suspect given some of the audit deficiencies found at these RAs and given Symantec's own investigations . Furthermore, this revalidation process, which discovered that CrossCert was not keeping adequate records presumably is continuing beyond the end of their issuance processMarch deadline Mozilla has set for using only the ten defined domain methods in version 1. The Baseline Requirements, in section 4.9.1.1 item 9, state that of the CA SHALL revoke a certificate if "The CA is made aware that the Certificate was not issued in accordance with these Baseline Requirements or the CA’s Certificate Poliy or Certification Practice Statement". However, Symantec did is not revoke all the certificatesone of those ten===Further Comments and Conclusion===
When Symantec put various controls and restrictions in place following the previous "test cert" incident, those controls, checks and restrictions did not extend to their RA network. Symantec say that this is because the test tool used in the previous incident was not available to RAs; however, it does not seem to be a great leap to have looked for similar capabilities and problems elsewhere in their issuance process.
Symantec made a number of comments on this issue - [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831038 0], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831933 1], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831933 2], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8838825 3], [https://bug1334377.bmoattachments.org/attachment.cgi?id=8843448 4]. ==Issue XXX: RA Program Audit Issues (2013 or earlier - March January 2017)==
Symantec's RAs appear to have had a history of poor compliance with the BRs and other audit requirements, facts which were known to Symantec but not disclosed to Mozilla or dealt with in appropriately comprehensive ways.
Over multiple years ([https://www.symantec.com/content/en/us/about/media/repository/symantec-webtrust-audit-report.pdf 2013-12-01 to 2014-11-30], [https://www.symantec.com/content/en/us/about/media/repository/GeoTrust-WTBR-2015.pdf 2014-12-01 to 2015-11-30]), Symantec's "GeoTrust" audits were qualified to say that they did not have proper audit information for some of these RAs. This information was in their management assertions, and repeated in the audit findings. So the poor audit situation was ongoing and known. Also, other audit reports, despite being in hierarchies accessible for issuance by the same RAs, did not have similar qualifications ([https://www.symantec.com/content/en/us/about/media/repository/Symantec-STN-WTCA-2015.pdf Symantec Trust Network, 2014-12-01 to 2015-11-30]).
One We currently know of four RAs who were in Symantec RA's program - CrossCert, Certisign, Certsuperior, had a and Certisur. [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831930 Certsuperior's audit] is particularly dreadful audit]:
* There was no legible CPS;
* non-trusted staff had access to issuance.
Ryan wrote[https: "have you examined //cert.webtrust.org/SealFile?seal=2168&file=pdf CrossCert's audit] does not list or cover the full number of Symantec roots under which they had issuance capability. Symantec's investigation discovered that CrossCert had the most recent set scope of audits? Do you, in your capacityas CA Certificate policy peer, believe the audits were correct audit reduced for theircost reasons.capability [https://bug1334377.bmoattachments.org/attachment.cgi?id=8831929 Certisign's audit] and role[https://cert.webtrust.org/SealFile? Note that several of them were "seal=2067&file=pdf Certisur's audit] are only WebTrust for CAs" audits -not "WebTrust neither CA appears to have a Baseline Requirements audit, which is required for CAs - SSL BR and Network Security"entities doing independent certificate issuance as they were. Do you believe thatcomplies with letter of the Baseline Requirements?"
===Symantec Response===
Symantec required the issues at CertSuperior to be fixed and a 90-day action plan was executed to fix them. However, until they decided to shut down the RA program, no certificates issued during the period of suspect operations were checked to see if the poor practice had caused misissuance. Despite the clear warning signs shown on the Certsuperior audit, Symantec did not put in place any monitoring of their RAs, other than audit, to check that they were correctly performing the tasks delegated to them under the BRs. There were some - overridable - technical checks on certificate issuance. Symantec appears to have taken no action to deal with that fact that Certisign and Certisur did not have the correct audits.
Despite the clear warning signs shown on these audits, Symantec did not put in place any monitoring of their RAs, other than audit, to check notice that CrossCert's audits did not cover all the relevant roots until they were correctly performing did the tasks delegated to them under the BRs. There were some - overridable - technical checks on certificate issuanceRA investigation in early 2017.
==Issue XXX: Incomplete RA Program Remediation (February - March 2017)==
At the time Symantec shut down their RA program, they had four RAs - CrossCert, Certisign, Certsuperior, and Certisur. Symantec committed to revalidating all certificates issued by those RAs. Independent of the rightness or otherwise of this course of action, it should have been applied consistently. However, the program previously had additional RAs, and Symantec has as yet taken no action to revalidate the certificates that they issued, despite some still being valid. Those RAs include at least E-Sign (from [https://cert.webtrust.org/SealFile?seal=1873&file=pdf at least March 1st 2014] to [https://cert.webtrust.org/SealFile?seal=1931&file=pdf at least July 31st 2015]) and may include others.
Accountapprovers, antispam, confirm, emeritus
4,925
edits

Navigation menu