Google catches bad digital certificates from Egyptian company

The incident is the latest example of longstanding problems around the issuance of digital certificates, which are used to encrypt data and verify the legitimacy of websites.

Google detected on March 20 that unauthorized digital certificates had been issued for several of its domains by MCS Holdings, a Cairo-based networking and security company, wrote Adam Langley, a Google security engineer.

The unauthorized certificates would have allowed MCS Holdings to spy on communications between Google and users on its network. Langley wrote that Google does not, however, believe the certificates were used for that purpose.

"We have no indication of abuse, and we are not suggesting that people change passwords or take other action," he wrote. "At this time, we are considering what further actions are appropriate.

Both Google and Mozilla, the developer of the Firefox browser, were instructing their browsers to block a higher level digital certificate -- known as an intermediate one -- which was used by MCS Holdings to issue the unauthorized ones.

The intermediate digital certificate was issued to MCS Holdings by the China Internet Network Information Center (CNNIC), a nonprofit organization that is administered by the Cyberspace Administration of China. CNNIC is a Certificate Authority, which is a considered a trusted organization that verifies digital certificates.

All Web browsers were coded to trust the certificates CNNIC issues, wrote Mozilla's security team in a blog post, which means the unauthorized ones issued by MCS Holdings would not trigger a warning.

Google contacted CNNIC when it detected the unauthorized certificates, Langley wrote. CNNIC said that MCS Holdings was only supposed to use the intermediate certificate to generate other certificates for the domains it owns.

Instead, MCS Holdings put the CNNIC intermediate certificate into a firewall, which was designed to inspect traffic that is encrypted by SSL/TLS. Many companies and organizations terminate encrypted traffic at a proxy so they can inspect it for security reasons.

But such proxies aren't supposed to have the power to generate certificates for other domains, Langley wrote. CNNIC, he wrote, "delegated their substantial authority to an organization that was not fit to hold it."

CNNIC told Google it would revoke the certificate. MCS Holdings couldn't immediately be reached for comment.

Security experts have long warned of the problems with wrongly issued digital certificates. To combat the problem, Google has pushed its Certificate Transparency project, which is aimed at quickly detecting SSL/TLS certificates that have been mistakenly issued or acquired by hackers.

Many major online services are also using a technique called certificate key pinning to bolster security. It allows online services to specify which certificate authorities have issued valid digital certificates for their sites and reject ones that haven't come from known authorities.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk