Firefox and Internet Explorer pull trust in DigiCert Malaysia SSL certificates
Malaysian security authority has trust revoked after weak encryption found
By John Ribeiro | Published: 10:01, 07 November 2011
Mozilla and Microsoft said Thursday they are revoking trust in all certificates issued by Digicert, a Malaysian intermediate certificate authority, after it was found that it had issued 22 certificates with weak 512 bit keys and missing certificate extensions and revocation information.
The Malaysian company was issued an intermediate CA certificate in July, 2010 by Entrust, which was licensed for distribution with SSL (Secure Sockets Layer) and S/MIME (Secure/Multipurpose Internet Mail Extensions) certificates.
Entrust said in a bulletin on its website that it had been discovered that Digicert Malaysia has issued certificates with weak 512 bit RSA keys and missing certificate extensions. Entrust has revoked the 512 bit certificates issued by Digicert and made them available to major browser vendors to blacklist if found appropriate, it added.
Related Articles on Techworld
Digicert in Malaysia does not have any relationship with the US-based DigiCert authority.
Digicert Malaysia could not be immediately reached for comment. It said on its website that it is at the centre of an effective trust model that the Malaysian government is creating to address the issue of information security, and the negative perception about online transactions. The company said it was licensed by the Malaysia government, and its "trust solutions are legally recognised under Malaysian law."
Entrust said it will revoke the intermediate CA certificate on or before Tuesday, to give Digicert Malaysia's customers a "modest amount of time" to replace their SSL server certificates. Entrust has meanwhile made the intermediate certificate available to the browser vendors for blacklisting.
The certificates in question were issued to a mix of Malaysian government websites and internal systems, Mozilla said in its security blog. "We do not believe other sites are at risk," it added.
Mozilla is revoking trust in all certificates issued by Digicert in Malaysia, while clarifying that it was not a Firefox specific issue, and the update will be in Firefox 8 and Firefox 3.6.24. Mozilla said the issue was reported to it by Entrust.
Firefox 3.6.24 is scheduled for release on November 8 while Firefox 8 will release on November 17, according to Mozilla.
Microsoft will revoke trust in Digicert Malaysia in an update to be released through Windows Update, said Jerry Bryant, group manager of response communications for Trustworthy Computing at the company, in a blog post.
"There is no indication that any certificates were issued fraudulently, however, these weak keys have allowed some of the certificates to be compromised," Bryant said. The compromised certificates could allow an attacker to impersonate the legitimate owner thus making the user believe they are trusting a website or signed software that was created for malicious use, he added.
Google is blocking serial numbers that correspond to the 22 certificates. As a larger measure, it plans to block the Digicert certificate by Tuesday, the date also decided upon by Entrust.
There is no evidence that the Digicert Malaysia certificate authorities have been compromised, Entrust said.
Comments
Edwin said: MemalukanBolehlah kamu bersorak-sorak di bawah tempurung kamu sendiri betapa hebatnya Projek yang kamu lancarkanpadahal bagi orang luar Kamu tu Berotak kampung Macamlah ratio kes jenayah yang dilaporkan RENDAH sehingga Lebih SELAMAT dari Singapura ketawalah ENGKAU sendiri memang BODOH betul
website authority checker said: Ha Ha Ha Malaysia Boleh this may be akin to a professional body which used to be regarded with some respects in the transport industry Its standard of expections was high enough to see some 60 passes among the students To oblige the recognition of the Malaysian Gomen it then allowed a Bumiputra Institution to take over the local examination Presto every student seems to be able to pass provuded the fee is paid to a private institution whose self-proclaimed expertise allowed him to be bestowed a fellowship of the Insitute To make the story short the International body finally suspended the local chapter the right to conduct any examination Reason simple enough you pay you pass hence one can understand the mind-set on creating As in all local examinations and somehow these A-students seemed unable to achieve much at international level Yes some one said shiok sendiri syndrome has permeated through our DNA In every aspect of our endeavour we seem to believe the rest of the world is stupid enough for our bluff with our imagination of Malaysia Boleh