<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><div lang="en-US" style="margin-bottom: 0cm"><span class="Apple-tab-span" style="white-space:pre"> </span>Issuing wildcard ssl
certificates (like *.company.eu ) has become a common commercial
practice among certification authorities.</div><div lang="en-US" style="margin-bottom: 0cm"><br></div>
<div id="Section1" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_131526259011140"></a><span class="Apple-tab-span" style="white-space:pre"> </span>They are convenient to install in production environments , but this
come with a risk. </div>
</div>
<div id="Section2" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111401"></a>
If they are compromised at final customer site , it's their own
responsibility .</div>
</div>
<div id="Section3" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111402"></a>
If they are compromised (faked) at CA (certification authority )
level , it's another story, the whole Internet trust system falls a
part (especially the ebusiness and egovernment applications rely
heavily on ssl ).</div>
</div>
<div id="Section4" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111403"></a><span class="Apple-tab-span" style="white-space:pre"> </span>This thing happened recently in a EU country, The Netherlands.</div>
</div>
<div id="Section5" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111404"></a>
The CA seem to be revoked by dutch government (Isoc.nl could kindly
give us some fresh news about this issue) and at least by Mozilla
foundation, but what strikes me is the extent of the fake
certificates (whole *google.com , *com and many others).</div><div lang="en-US" style="margin-bottom: 0cm"><br></div></div>
<div id="Section7" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111406"></a><span class="Apple-tab-span" style="white-space:pre"> </span>Isoc should work with the Eu to propose and maintain a trusted list
of CA's , then extend it globally. It's a registry , just like .org,
and it's doable.
</div>
</div>
<div id="Section8" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><br>
</div>
</div>
<div id="Section9" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111408"></a><span class="Apple-tab-span" style="white-space:pre"> </span>At Isoc Romania ,we are trying to do this for some years, pushing
the government to act. </div>
</div>
<div id="Section10" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_1315262590111409"></a>
The romanian and french government are now favorable
and could push this initiative, the dutch should probably be urged
to join. </div><div lang="en-US" style="margin-bottom: 0cm">Isoc or Eurid could maintain this trusted list.</div>
</div>
<div id="Section11" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_13152625901114010"></a>
There are also two major eu projects ( PEPPOL -
eprocurment and STORK) having emphasized the necessity of a such
trusted list.</div>
</div>
<div id="Section12" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><br>
</div><div lang="en-US" style="margin-bottom: 0cm"><span class="Apple-tab-span" style="white-space:pre"> </span>We would like to hear opinions from other chapters (are they aware of other compromised CA? )</div>
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_131526259011182"></a><br><br>
</div>
</div>
<div id="Section13" dir="LTR">
<div lang="en-US" style="margin-bottom: 0cm"><a name="yui_3_2_0_19_13152625901114012"></a>
References :</div>
</div>
<div id="Section14" dir="LTR">
<div style="margin-bottom: 0cm"><a name="yui_3_2_0_19_13152625901114013"></a><a name="yui_3_2_0_19_1315262590111161"></a>
<a href="http://en.wikipedia.org/wiki/Certificate_authority"><font color="#0000ff"><span lang="en-US"><u>http://en.wikipedia.org/wiki/Certificate_authority</u></span></font></a><span lang="en-US"><br></span><br>
</div>
</div>
<div id="Section15" dir="LTR">
<div style="margin-bottom: 0cm"><a name="yui_3_2_0_19_131526259011150"></a><a name="yui_3_2_0_19_13152625901114014"></a><a name="yui_3_2_0_19_131526259011137"></a>
<a href="http://www.net-security.org/secworld.php?id=11565"><font color="#0000ff"><span lang="en-US"><u>http://www.net-security.org/secworld.php?id=11565</u></span></font></a><span lang="en-US"><br></span><br>
</div>
</div>
<div style="margin-bottom: 0cm"><a href="http://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/"><font color="#0000ff"><span lang="en-US"><u>http://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/</u></span></font></a></div></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Best Regards</div><div>Eduard Tric</div><div>Isoc Romania</div><div>http://isoc.ro</div><div><br></div><div><br></div><div><br></div><div><br></div></div></body></html>