A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

ICP-Brasil officially stopped emitting public-facing SSL&#x2F;TLS certificates in October: <a href="https:&#x2F;&#x2F;www.gov.br&#x2F;iti&#x2F;pt-br&#x2F;assuntos&#x2F;noticias&#x2F;indice-de-noticias&#x2F;importante-esclarecimentos-sobre-o-fim-dos-certificados-ssl-tls-pela-icp-brasil" rel="nofollow">https:&#x2F;&#x2F;www.gov.br&#x2F;iti&#x2F;pt-br&#x2F;assuntos&#x2F;noticias&#x2F;indice-de-not...</a><p>This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google&#x27;s CAA rules. Hope this CA gets banned on Microsoft OSes for good.

It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don&#x27;t trust this CA. Arguably, Microsoft&#x2F;Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.

Microsoft seems to be casual about trusting CAs, isn&#x27;t transparent in their inclusion decisions, and their trust store is quite large. Any reasonable website would only use a certificate trusted by a quorum of browsers (especially Chrome), so the benefit of the extraneous CAs seems low.<p>I&#x27;m not a Windows user, but I have to wonder if there&#x27;s a way to use the Chrome trust store on Windows&#x2F;Edge. I can&#x27;t imagine trusting Microsoft&#x27;s list.

Things like this make me wonder why certificates are not <i>also</i> signed by the certificate owner.<p>Right now, a CA can issue a certificate for any public key and domain they like. A rogue trusted CA can intercept all traffic.<p>If a certificate also included a signature by the owner of the public key signed by the CA (using their private key, signed over the CA signature), then a CA would no longer have this ability.<p>What am I missing?

I wonder why Brazil has their CA trusted by Microsoft in the first place, while Kazakhstan [1], for example, wasn&#x27;t.<p>1. <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Kazakhstan_man-in-the-middle_attack" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Kazakhstan_man-in-the-middle_a...</a>

The simple solution would be to have independent entities offer trust assertions about CAs and to allow users to consider multiple entities&#x27; views in their decision about whether to trust. It&#x27;s surprising this doesn&#x27;t exist yet when the attack vector is so clear.

Not clear (to me) in the original post -- was this done accidentally or intentionally?

Speculative guess, but it sounds like intentional collusion&#x2F;coercion between government and big corporations.<p>ie: Brazilian government demands Microsoft to grant them MITM access from Windows machines, in order for the right to do business in the country.

Does anyone have a list of state ( associated ) CA&#x27;s so that I can ditch them all ?

&quot;Windows users deserve better!&quot; As if Microsoft cares about their users. But this is clearly negligent behavior and open to lawsuits..hopefully.

Can anyone tell me which CA is used by Open Banking in Brazil? The infrastructure is heavily based on PKI. I assume it&#x27;s not this one?

@dang Can we update the link to the original source?<p><a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1934361" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1934361</a>

It&#x27;s not Microsoft being careless about CAs. That&#x27;s been made on purpose by them to comply with some request in order to keep a slice of their market.

Can someone explain what could be done with that and by whom?

How do i remove this CA from windows and Edge?

Tangentially related:<p>The system is deeply flawed, which is something I realized fifteen years ago when I was put into a situation where I had to use online banking. (Had to being the nearest branch of any bank was an hour long flight away, though there was an ice road you could use in the winter.) One of my first questions of the bank was: who issued their certificate. They didn&#x27;t have a clue what I was talking about. I suppose I could have pushed the question until I found someone who did know, but I also realized that a random person asking about security would be flagged as suspicious. The whole process was based upon blind trust. Not just trust in the browser vendors to limit themselves to reputable CA, but of the CAs themselves and their procedures&#x2F;policies, and who knows what else.

Lol. &quot;This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google&#x27;s CAA rules. Hope this CA gets banned on Microsoft OSes for good.&quot;<p>Yeah, this is after the certificate was issued, and my guess, used.<p>Also, has anyone tried to look up CT logs lately? I tried. Can get maybe a single FQDN if you look, but trying to do wildcards or name-alikes, nothing worked. Most of the CT searching websites were straight up broken. Clearly nobody is actually looking at CT logs.<p>CAs are a joke. There&#x27;s a dozen different ways to exploit them, they <i>are</i> exploited, and we only find out after the fact, if it&#x27;s a famous enough domain.<p>We could fix it but nobody gives a shit. Just apathy and BAU.

So an incompetent CA is trusted by an even more incompetent company, Microsoft?<p>Is anybody else surprised at this point?

this is an issue with companies being too big

You care about google? Look at those links, they are loaded with critical government stuff. Omg