Apple blocked CNNIC CA months after MITM attacks

Submitted by percy on Thu, Sep 24, 2015

In March of this year, Google found unauthorized digital certificates for several Google domains. The root certificate authority for these domains was the China Internet Network Information Center(link is external) (CNNIC). CNNIC was controlled by the Chinese government through theMinistry of Industry and Information Technology(link is external) and is now under the management of theCyberspace Administration of China(link is external) (CAC). CNNIC was recognized by all major browsers as a trusted Certificate Authority. If CNNIC signs a fake certificate used in a man-in-the-middle attack, no browser will warn of any unusual activity unless the certificate is pinned.

After Google found these unauthorized certificates, both Google and Firefox revoked its trust in CNNIC a few days later, a development we at GreatFire.org have adovacting for since 2013. Apple and Microsoft on the other hand, did not revoke their trust in CNNIC, nor did they make any announcements regarding the security compromise.

In June 2015, Apple quietly published a support article titled “About the security partial trust allow list(link is external)”. This announcement was made quietly and as far as we can see was not picked up in the media. We did not notice this change until this week. Apple states in the support article that “an intermediate certificate was incorrectly issued by the certificate authority CNNIC. This issue was addressed through the addition of a mechanism to partially trust a CA by trusting only a set of certificates.” This is the same strategy that has been taken by Google and Firefox to block CNNIC.

Apple also published the full domain list(link is external) signed by CNNIC which might be interesting to researchers.

Microsoft is the only major browser operator left that still trusts CNNIC-issued CAs. Microsoft pointed to a help article(link is external) when requested for comment. Microsoft didn’t indicate any action against CNNIC in the article. We urge Microsoft to revoke CNNIC following Google, Mozilla and Apple's lead and limit CNNIC's authority to the domain list published by Apple.