This topic is for discussion of the following blog post and related issues: The CA's Role in Fighting Phishing and Malware - Let's Encrypt - Free SSL/TLS... Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware …

It is really stupid to add an CA to the certstore, include the private key for the CA in the computer of each customer. And then also tell that this is used to protect data collected from the customer PC for transmission. I think even an student i the first semester would fail with such an softwar…

The Safe Browsing API check is a good point in time check, at the time of issuance. However, the API should really be frequently monitored post certificate issuance as well. Negative changes in domain status should generate a revocation event. Without doing this, we are only incentivizing the bad g…

You cannot revocate a cert automatically based on an API, it can have false positives or maybe someone can do something to flag your site and revoke your cert.

Yes, you are correct. Ideally you should have a person in between to logically inspect before revocation. However, this system is unique in that there is no monetary penalty for requesting a new cert. So while I would agree with you in a standard CA system (where folks are touching the validation a…

No, the problem is with people who don’t understand what a (DV) cert certifies. It’s not a magic seal that certifies a lack of malware or something like that. A CA’s job is not to vouch for “safe sites” or “protect end users”. If you ever told people who know even less than you do, that a website i…

Not sure if this danger has been mentioned before, but if this also applies to renewal, this means that previously secured sites can suddenly lose their TLS, because they are listed in Safe Browsing - including when that happens erroneously, and it’s not exactly a secret that this occurs with a non-…

[image] joepie91: Additionally, if an adversary can trick Safe Browsing into falsely believing that a site carries malware, they can intentionally deprive a site of access to a TLS certificate. If an adversary can do that, they've also just ensured that a large majority of users won't be able…

[image] pfg: If an adversary can do that, they've also just ensured that a large majority of users won't be able to access the site at all. While correct (and there have been a few cases of this happening), it still removes the choice of the user to ignore this warning (eg. if they know that …

I think getting off the list probably is manual while getting on the list may be automatic but even if not, getting off will probably take some time.

Any update on this area? Statistics of numbers of cert requests rejected due to Google Safe Browsing API hits? Are issued certificates revoked if Google Safe Browsing API reports an issue after Let’s Encrypt cert is issued? Thanks, John P.

The CA's Role in Fighting Phishing and Malware

Issuance Policy

Topic		Replies	Views
CA's Role in Fighting Phishing and Malware ISRG/Organizational	23	3154	February 11, 2022
Misused certificates Issuance Policy	47	13425	September 7, 2023
Phishing sites and SSL Certificates Issuance Policy	11	7325	July 17, 2017
Why does let's encrypt issue SSL certificates to fraudulent sites Issuance Policy	32	12483	February 5, 2024
SSL Certificate Issues / CAs enabling Scammers? Issuance Policy	16	1867	February 17, 2022

The CA's Role in Fighting Phishing and Malware

Related topics