Google Online Security Blog: Sustaining Digital Certificate Security

Security Blog

The latest news and insights from Google on security and safety on the Internet

Sustaining Digital Certificate Security

28. Oktober 2015

Posted by Ryan Sleevi, Software EngineerThis post updates our previous notification of a misissued certificate for google.coma report164 certificates2,458 certificates

A post-mortem analysis that details why they did not detect the additional certificates that we found.

Details of each of the failures to uphold the relevant Baseline Requirements and EV Guidelines and what they believe the individual root cause was for each failure.

Following the implementation of these corrective steps, we expect Symantec to undergo a Point-in-time Readiness Assessment and a third-party security audit. The point-in-time assessment will establish Symantec’s conformance to each of these standards:

WebTrust Principles and Criteria for Certification Authorities
WebTrust Principles and Criteria for Certification Authorities – SSL Baseline with Network Security
WebTrust Principles and Criteria for Certification Authorities – Extended Validation SSL

The third-party security audit must assess:

The veracity of Symantec’s claims that at no time private keys were exposed to Symantec employees by the tool.
That Symantec employees could not use the tool in question to obtain certificates for which the employee controlled the private key.
That Symantec’s audit logging mechanism is reasonably protected from modification, deletion, or tampering, as described in Section 5.4.4 of their CPS.