Internal-use SSL certificates pose security risk for upcoming domain extensions

CAs have issued certificates for internal domain names that could become public soon, causing conflicts, ICANN warns

The practice of issuing SSL certificates for internal domain names with unqualified extensions could endanger the privacy and integrity of HTTPS communications for upcoming generic top-level domains (gTLDs), according to a security advisory from the Internet Corporation for Assigned Names and Numbers (ICANN).

The advisory was finalized by ICANN's Security and Stability Advisory Committee (SSAC) last week and warns that existing SSL certificates which have been issued for non-public domain names like those used to identify servers inside private networks, could be used to hijack HTTPS traffic for real domain names as new gTLDs become operational. ICANN oversees the Internet's top-level domain name space.

SSAC gave the example of an SSL certificate issued by a Certificate Authority (CA) to Australian clothing retailer Quiksilver for its webmail.quiksilver.com.au domain. That certificate is also valid for alternative non-publicly-recognizable domain names like qsauhub01, qsauhub01.sea.quiksilver.corp, qsauhub02, qsauhub02.sea.quiksilver.corp, and autodiscover.sea.quiksilver.corp.

The .corp domain extension has been used internally on private corporate networks for a very long time, but is currently being considered for future public use as a new gTLD. According to ICANN's website there are six different organizations that applied to become .corp registries.

"If an attacker obtains a certificate before the new TLD is delegated, he/she could surreptitiously redirect a user from the original site to the attacker site, present his certificate and the victim would get the Transport Layer Security/SSL (TLS/SSL) lock icon," the SSAC said in the advisory. "This poses a significant risk to the privacy and integrity of HTTPS communications as well as other protocols that use X.509 certificates (e.g. TLS/SSL-based email communication)."

In a test case, a researcher working with SSAC successfully applied for and obtained an internal-use certificate for www.site from a CA. While .site is not a gTLD yet, it will most likely become one. Some .site registry applicants already offer the possibility to pre-register domain names with this extension.

The researcher set up https://www.site with the newly obtained certificate and verified that various browsers recognized the certificate as valid.

The SSAC also searched SSL certificate data collected in 2010 by the Electronic Frontier Foundation's SSL Observatory project and found 37,244 internal name certificates issued by 157 CAs. Out of those, 1,053 certificates were for domains that ended in one of 63 applied-for gTLDs.

The real number of existing internal name certificates that would conflict with upcoming gTLDs is probably much higher, the SSAC said. The SSL Observatory data is from 2010 and only contains publicly available certificates on the IPv4 (Internet Protocol version 4) network, like the Quiksilver one, that are valid for both public and non-public domain names, it said.

"Its methodology is not capable of discovering internal certificates that are not associated with a public certificate," the SSAC said. "Since the key purpose for internal name certificates is for internal use, it is highly likely that many internal certificates are unaccounted for."

The CA/Browser (CA/B) Forum, an organization of certificate authorities and browser vendors that drafts and publishes guidelines for the issuance of publicly trusted certificates, asked its CA members in July 2012 not to issue new certificates for internal server names that have an expiration date beyond Nov. 1, 2015. On Oct. 1, 2016, all CAs are expected to revoke the remaining certificates for internal server names that are still valid on that date, putting a permanent end to this type of certificate.

"Although this is welcome news, this is still problematic because ICANN plans to delegate new TLDs in 2013, introducing vulnerability for potential new gTLDs until October 2016," SSAC said.

ICANN reached out to the CA/B Forum about the problem and presented the SSAC's advisory at the organization's annual meeting in February. As a result, the CA/B Forum passed a ballot requiring all CAs to cease issuing new certificates that include gTLDs within 30 days of those gTLDs becoming operational. The CAs will also have to revoke all existing certificates for domain names under a new gTLD within 120 days after ICANN publishes the contract for that respective gTLD on its website, unless certificate owners register their private domain names publicly under the new gTLD.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags ICANNonline safetysecuritypki

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?