Limiting power of untrusted certificate authorities
Limiting power of untrusted certificate authorities is disclosed. An unstructured list of certificate authorities associated with an application may be augmented with a limiting database that includes a per target certificate authority list. For targets identified in the limiting database, the certificate of an entity may be trusted only when the certificate authority is in the target's list, even if the certificate authority is present in the unstructured list of certificate authorities.
1 . A method comprising:
receiving, at an application, a certificate from a target that has been signed by a certificate authority, wherein the application is associated with a list of certificate authorities and a limiting database that defines, by policy, authoritative designations identifying, for each target, one or more certificate authorities that are permitted to issue certificates for the target, the limiting database being provisioned to the application as client-side policy by an entity trusted by the application and being independent of control by the target, the limiting database defining, for targets included therein, a subset of the list of certificate authorities that are authorized for the respective target, the limiting database being enforced to override or restrict trust decisions made using the list of certificate authorities;
performing certificate verification according to a policy, wherein the policy includes:
determining whether the target is included in the limiting database;
determining whether the certificate authority that signed the certificate is identified in the limiting database as a certificate authority permitted to issue certificates for the target when the target is included in the limiting database; and
when the target is included in the limiting database, determining trust based solely on the limiting database without consulting authorization data published by the target, terminating or refusing communication with the target when the certificate authority that signed the certificate is not identified as permitted for the target in the limiting database, even if the certificate authority is present in the list of certificate authorities, and communicating with the target only when the certificate is verified using the limiting database.
2 . The method of claim 1 , further comprising performing the certificate verification for signed code, signed email or mail servers using the limiting database.
3 . The method of claim 1 , wherein the application is a browser and the target is a website.
4 . The method of claim 1 , wherein the targets comprise website names and wherein the limiting database associates website names with authorized certificate authorities.
5 . The method of claim 1 , further comprising defaulting to the list of certificate authorities to perform certificate verification when the target is not present in the limiting database.
6 . The method of claim 1 , wherein the limiting database supersedes the list of certificate authorities when performing the certificate verification.
7 . The method of claim 1 , wherein certificate authorities present in the limiting database and not present in the list of certificate authorities are not added to the list of certificate authorities.
8 . The method of claim 1 , further comprising retrieving the limiting database from a specified location.
9 . The method of claim 1 , further comprising disconnecting from the target when the target is included in the limiting database and the certificate authority is not present in the limiting database.
10 . The method of claim 1 , wherein the limiting database comprises a per website certificate authority list.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving, at an application, a certificate from a target that has been signed by a certificate authority, wherein the application is associated with a list of certificate authorities and a limiting database that defines, by policy, authoritative designations identifying, for each target, one or more certificate authorities that are permitted to issue certificates for the target, the limiting database being provisioned to the application as client-side policy by an entity trusted by the application and being independent of control by the target, the limiting database defining, for targets included therein, a subset of the list of certificate authorities that are authorized for the respective target, the limiting database being enforced to override or restrict trust decisions made using the list of certificate authorities;
performing certificate verification according to a policy, wherein the policy includes:
determining whether the target is included in the limiting database; and
determining whether the certificate authority that signed the certificate is identified in the limiting database as a certificate authority permitted to issue certificates for the target when the target is included in the limiting database; and
when the target is included in the limiting database, determining trust based solely on the limiting database without consulting authorization data published by the target, terminating or refusing communication with the target when the certificate authority that signed the certificate is not identified as permitted for the target in the limiting database, even if the certificate authority is present in the list of certificate authorities, and communicating with the target only when the certificate is verified using the limiting database.
12 . The non-transitory storage medium of claim 11 , further comprising performing the certificate verification for signed code, signed email or mail servers using the limiting database.
13 . The non-transitory storage medium of claim 11 , wherein the application is a browser and the target is a website.
14 . The non-transitory storage medium of claim 11 , wherein the targets comprise website names and wherein the limiting database associates website names with authorized certificate authorities.
15 . The non-transitory storage medium of claim 11 , further comprising defaulting to the list of certificate authorities to perform certificate verification when the target is not present in the limiting database.
16 . The non-transitory storage medium of claim 11 , wherein the limiting database supersedes the list of certificate authorities when performing the certificate verification.
17 . The non-transitory storage medium of claim 11 , wherein certificate authorities present in the limiting database and not present in the list of certificate authorities are not added to the list of certificate authorities.
18 . The non-transitory storage medium of claim 11 , further comprising retrieving the limiting database from a specified location.
19 . The non-transitory storage medium of claim 11 , further comprising disconnecting from the target when the target is included in the limiting database and the certificate authority is not present in the limiting database.
20 . The non-transitory storage medium of claim 11 , wherein the limiting database comprises a per website certificate authority list.