I'm writing an article about new government law in Kazakhstan. The law was accepted in December, but now one of our providers announced information for small and medium business how to install government-provided root SSL certificate: https://www.beeline.kz/b2b/sme/ru/press_centers/10040

Yes, they really want to listen the whole traffic of all citizens.

I want to show in my article that this is really-really bad solution. And I need all information about possible vulnerabilities of it.

The certificate is valid for 4 years, data size, as I think, 1024 bytes.

Link to the cert: https://www.beeline.kz/uploads/document/file/11120/QAZNET.rar


closed as off-topic by otus, e-sushi Mar 10 '16 at 19:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Requests for analyzing or deciphering a block of data are off-topic here, as the results are rarely useful to anyone else." – e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.


First - please REALLY check the certificate, download it, open and have a look into details (4096 bit, 30y validity). I don't think your government wants to be insecure themselves (so other parties will act on behalf of it).

If the certificate is to be used as a root (or issuing) certificate for other nationally issued certificates, you need it to be trusted (otherwise all national sites won't be recognized as trusted). It cannot be used to decrypt your traffic (as man in the middle) itself.

The only question to be answered, how trustworthy is the "Qaznet" issuer. Nothing prevents them (except the law and they would loose all credibility) to issue e.g. a google server certificate which will be trusted to all having the root / intermediate certificate as trusted (see http://arstechnica.com/security/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/ ). It is all about the trust. If you trust the CA provider or not (Qaznet).


Not the answer you're looking for? Browse other questions tagged or ask your own question.