known bad certs blocklist

[Jan Schaumann]

Hello,

Is there a community-shared blocklist of known bad
certs (keys)?

Chrome has
https://chromium.googlesource.com/chromium/src/+/master/net/data/ssl/blocklist/README.md

Apple / Safari has
https://support.apple.com/en-us/103255

I don't recall if Firefox has a list?

Either way, it would be useful to have a community
shared list of known compromised keys or otherwise
revoked roots or intermediates. Does that already
exist?

-Jan

[Ben Wilson]

Hello Jan,

This OneCRL list might be what you are looking for - https://crt.sh/mozilla-onecrl.

Ben

--
You received this message because you are subscribed to the Google Groups "dev-secur...@mozilla.org" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dev-security-po...@mozilla.org.
To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/ZZ1xe9_3hGFovkqT%40netmeister.org.

[Matt Palmer]

On Tue, Jan 09, 2024 at 11:16:59AM -0500, 'Jan Schaumann' via dev-secur...@mozilla.org wrote:
> Either way, it would be useful to have a community
> shared list of known compromised keys or otherwise
> revoked roots or intermediates. Does that already
> exist?

For known-compromised keys, there's https://pwnedkeys.com.

- Matt

[Matthew Hardeman]

I also was going to point out that these are probably [at least] three different concepts:

1.  There are untrusted / revoked / distrusted root and/or intermediate CERTIFICATES.

2.  There are KEYS which have been COMPROMISED (known/published/demonstrated public -> private key mapping) which are unsuitable for any use in any certificate in the WebPKI.

3.  There are KEYS which are algorithmically WEAK and are unsuitable for any use in any certificate in the WebPKI.

Of the latter two, there is much overlap as researchers have published some lists of instances of the third case as specific examples, which makes them also fit in the 2nd case.

Importantly, it is likely that the person asking the question likely needs to separately consider certificates which are unknown/untrusted/revoked and keys which are bad for one of a number of reasons.

--
You received this message because you are subscribed to the Google Groups "dev-secur...@mozilla.org" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dev-security-po...@mozilla.org.

To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/7af92426-fd46-49c0-b6d5-c18a258fc4d9%40mtasv.net.