Several CAs have issued intermediate CA certificates with duplicate
serial numbers. This is a clear violation of the serial number
uniqueness requirement of the BRs and RFC5280 4.1.2.2. Below is a list
of all those known to crt.sh that chain to at least 1 NSS built-in root:
Issuer: https://crt.sh/?caid=140
Issuer O: AC Camerfirma SA CIF A82743287
Issuer CN: Chambers of Commerce Root
Subject CN: (id=1252) AC CAMERFIRMA AAPP
(id=12625404) AC Camerfirma Express Corporate Server
Serial #: 0d
Certs: https://crt.sh/?id=1252
https://crt.sh/?id=12625404
Revoked?: No
Issuer: https://crt.sh/?caid=935
Issuer O: Actalis S.p.A./03358520967
Issuer CN: Actalis Authentication Root CA
Subject CN: UniCredit Subordinate External
Serial #: 3e:5d:be:44:e7:51:5a:5a
Certs: https://crt.sh/?id=47081615
https://crt.sh/?id=147626411
Revoked?: No
Issuer: https://crt.sh/?caid=941
Issuer O: Atos
Issuer CN: Atos TrustedRoot 2011
Subject CN: Atos TrustedRoot Client-CA 2011
Serial #: 5b:6a:8e:8d:5a:86:71:8f
Certs: https://crt.sh/?id=12725513
https://crt.sh/?id=12725727
https://crt.sh/?id=12728899
Revoked?: No
Subject CN: Atos TrustedRoot CodeSigning-CA 2011
Serial #: 33:45:52:39:ec:16:dd:62
Certs: https://crt.sh/?id=18068233
https://crt.sh/?id=49643406
Revoked?: Yes
Subject CN: Atos TrustedRoot Server-CA 2011
Serial #: 6b:5d:91:bc:13:61:ce:75
Certs: https://crt.sh/?id=705899
https://crt.sh/?id=18068212
Revoked?: Yes
Issuer: https://crt.sh/?caid=138
Issuer O: SwissSign AG
Issuer CN: SwissSign Gold CA - G2
Subject CN: AffirmTrust Networking
Serial #: 84:3c:74:b1:aa:34:86:b1:c4:c7:a0:df:55:b5:e9
Certs: https://crt.sh/?id=3386
https://crt.sh/?id=1991456
Revoked?: No
Subject CN: Trend Micro Gold CA
Serial #: 49:e1:33:6e:94:e5:b6:a5:2d:a9:6e:d4:8a:e2:76
Certs: https://crt.sh/?id=12629343
https://crt.sh/?id=198226194
Revoked?: Yes
Issuer: https://crt.sh/?caid=656
Issuer O: Trustwave Holdings, Inc.
Issuer CN: Trustwave Organization Issuing CA, Level 2
Subject CN: Trustwave Enterprise CA
Serial #: 6b:49:d2:04
Certs: https://crt.sh/?id=12624965
https://crt.sh/?id=12629351
Revoked?: Issuer cert revoked (https://crt.sh/?id=95565)
Issuer: https://crt.sh/?caid=12391
Issuer O: Trustwave Holdings, Inc.
Issuer CN: Trustwave Enterprise CA
Subject CN: Trustwave Enterprise VPN CA
Serial #: 41:90:ae:5d
Certs: https://crt.sh/?id=12625419
https://crt.sh/?id=12629788
Revoked?: Issuer's issuer cert revoked (https://crt.sh/?id=95565)
Issuer: https://crt.sh/?caid=1450
Issuer O: WoSign CA Limited
Issuer CN: CA 沃通根证书
Subject CN: 中国湖南 EV 服务器证书
Serial #: 44:80:7b:20:7c:f2:05:2e:8d:34:11:77:02:66:d2:95
Certs: https://crt.sh/?id=7841622
https://crt.sh/?id=9318242
Revoked?: No (x-certs from StartCom not yet in OneCRL; StartCom roots
still in NSS)
Subject CN: CA 沃通 EV 代码签名证书
Serial #: 3a:de:c4:02:27:0b:f4:ee:9e:89:2c:c6:5e:0a:da:21
Certs: https://crt.sh/?id=12728869
https://crt.sh/?id=12729072
Revoked?: No (x-certs from StartCom not yet in OneCRL; StartCom roots
still in NSS)
P.S. Here's the query I ran on crt.sh to find these certs:
select count(*), min(c.id), max(c.id), c.issuer_ca_id,
encode(x509_serialNumber(c.certificate), 'hex') from certificate c,
ca_certificate cac where c.id=cac.certificate_id and exists (select 1
from ca_trust_purpose ctp where ctp.ca_id = c.issuer_ca_id and
ctp.trust_context_id=5) group by c.issuer_ca_id,
x509_serialNumber(c.certificate) having count(*) > 1 order by count(*) desc;
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
_______________________________________________
dev-security-policy mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security-policy
