Scott_Helme_

The public key is calculated from the private key, so it all still works, it's just a public key for a private key of 4.

If an attacker takes the CA key and issues a valid certificate, but does not log it to CT, mainstream browser clients will not accept it.

When a certificate is logged to CT, you get back an SCT, and the issuing CA will normally include that in the certificate. The browser will then accept this certificate as it has the correct SCTs (there are always at least two).

The attacker issued certificate hasn't been logged, so can't have an SCT, so won't be accepted by the browser.

We can't say that no certificates have been issued by an attacker. We can say that no certificates have been issued by an attacker that a modern browser client would accept.

But that's detectable and what we have MMD for, a log operator that does this can be found out.

Yes, exactly this.

Wouldn't that be almost 2,000 root CAs?

Also if it's the same CA operating a bunch of different roots for different TLDs, they're likely to just make the same mistake that impacts them all. Sadly, I can't see anything like this working.

Hey what's wrong with Passkeys?!

I'm not sure what laws apply to you where you live so you'd have to check, but you could also do this on pen and paper if that helps :)

Yep, it's a long tail. Anything that ships it's own CA bundle will ignore whatever you fix at the OS level. Those bundles are generally root-only and don't have revocation checking, so they can't block a bad intermediate cert.

The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.

If you've got the compute power, it's easy enough to have a go at it!

Apple has blocked the intermediates, so updating is good enough to resolve it for you.

Fair enough, call it a mix if you like. I'm happy to stand behind every claim in my post, and if something's wrong, tell me and I'll fix it.

I agree this is a burden placed on domain owners, but who else can know if a certificate for my domain 'scotthelme.co.uk' was supposed to be issued other than me, the owner of 'scotthelme.co.uk'?

Do you have any info on the malicious CT logs? I'd be interested to read something on that!

CAA records are only checked by the CA at the point of issuance, not by the client later. If they did, there are problems to consider:

1. A domain would have to keep the CAA records for a CA in place to keep using the certificates from that CA, but that means continuing to authorise new issuance too. Right now, I can remove the `letsencrypt.org` value to stop them from issuing new certificates for me, but I can keep using any certificates I have until they expire.

2. The client would need to have support for this new DNS RR type.

3. The client would need a secure way to query DNS, which is not widespread.