2
$\begingroup$

I'm writing an article about new government law in Kazakhstan. The law was accepted in December, but now one of our providers announced information for small and medium business how to install government-provided root SSL certificate: https://www.beeline.kz/b2b/sme/ru/press_centers/10040

Yes, they really want to listen the whole traffic of all citizens.

I want to show in my article that this is really-really bad solution. And I need all information about possible vulnerabilities of it.

The certificate is valid for 4 years, data size, as I think, 1024 bytes.

Link to the cert: https://www.beeline.kz/uploads/document/file/11120/QAZNET.rar

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

First - please REALLY check the certificate, download it, open and have a look into details (4096 bit, 30y validity). I don't think your government wants to be insecure themselves (so other parties will act on behalf of it).

If the certificate is to be used as a root (or issuing) certificate for other nationally issued certificates, you need it to be trusted (otherwise all national sites won't be recognized as trusted). It cannot be used to decrypt your traffic (as man in the middle) itself.

The only question to be answered, how trustworthy is the "Qaznet" issuer. Nothing prevents them (except the law and they would loose all credibility) to issue e.g. a google server certificate which will be trusted to all having the root / intermediate certificate as trusted (see http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ ). It is all about the trust. If you trust the CA provider or not (Qaznet).

Improve this answer
$\endgroup$
3
  • $\begingroup$ About the trust: groups.google.com/forum/#!searchin/mozilla.dev.security.policy/… $\endgroup$
    – Thunderbird
    Mar 10, 2016 at 15:45
  • $\begingroup$ Some updates on July 2019. Kazakhstan government is now enforcing all people in the country to install this root Qaznet certificate to "avoid disruptions of Internet access". Basically, we have one more country building a Great Firewall with all traffic being decrypted and monitored. $\endgroup$
    – Yeldar Kurmangaliyev
    Jul 18, 2019 at 12:56
  • $\begingroup$ @YeldarKurmangaliyev indeed, the situation is described as well in the bugzilla. Indeed this is misusing the CA authority. I believe the Google Chrome at least enforces using correct certificates for Google services, but for the rest .. seems the providers will allow decrypting the traffic :( If all providers will comply with the regulations, you cannot do much about it, maybe using foreign VPN or Thor (which can be blocked, but not decrypted). $\endgroup$
    – gusto2
    Jul 18, 2019 at 21:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.