14 DAY TRIAL // Microsoft will serve an update through Windows Update designed to revoke trust in a new Certificate Authority, after it removed all DigiNotar root certificates with a refresh in September.
According to the software giant DigiCert Sdn. Bhd. (Digicert Malaysia), an Intermediate Certificate Authority, was found in violation of the Microsoft Root Program requirements.
This alone was sufficient for the Redmond company to rebuke the web authentication authority.
“Microsoft was notified by Entrust, Inc, a certificate authority in the Microsoft Root program, that a Malaysian subordinate CA, DigiCert Sdn. Bhd issued 22 certificates with weak 512 bit keys,” revealed Jerry Bryant, Group manager, Response Communications, Trustworthy Computing.
“Additionally, this subordinate CA has issued certificates without the appropriate usage extensions or revocation information.”
Microsoft stressed that unlike the DigiNotar scenario from a few months back, this time around attackers did not get the chance to exploit the weak and deficient secure sockets layer certificates issued by Digicert Malaysia.
Still, the company has taken what can be interpreted as a preemptive measure, in order to prevent any potential issues.
“There is no indication that any certificates were issued fraudulently, however, these weak keys have allowed some of the certificates to be compromised. These compromised certificates could allow an attacker to impersonate the legitimate owner and make a user believe they are trusting a website or signed software that was created for malicious use,” Bryant added.
Microsoft also wanted to clearly make a distinction between DigiCert Inc., still a member of its Windows Root Certificate Program, and DigiCert Malaysia.
The software giant stressed that DigiCert Malaysia (DigiCert Sdn. Bhd) is “a Malaysian subordinate CA under Entrust and Verizon (GTE CyberTrust),” Bryant said.
“The subordinate CA has clearly demonstrated poor CA security practices and Microsoft intends to revoke trust in the intermediate certificates.”