4

It was difficult to find an explanation with a search engine, so I'm asking and answering here.

Seahorse, the Gnome keyring and Key manager shows several suspicious certs with all-blank fields under the "Default Trust" tab, when "Show Any" is on:

enter image description here

It's not clear where they're from, what they are, or how they go there. Do they represent a security risk? Have I Been Hacked?

  • Thanks. The answer on superuser is mostly wrong. They may be anonymous, but that doesn't explain what they're doing on my system. I've answered myself in order to help others solve this. I hope they find it. – John Denning Aug 14 at 11:05
  • cool! upvote and accept it when you can and Ill coment on the other to this one – Rinzwind Aug 14 at 12:16
8

There's an issue #299 for this on the Seahorse issue tracker.

TL;DR: these are distrusted certs marked as such for your protection in your distro's list of root CA's. Seahorse doesn't handle those well. It's a cosmetic problem, not a security one.

Long Version

Over the years, there have multiple incidents in which CA certs have been abused (hacked, used irresponsibly, etc'). Since your browser trusts any cert issued by these CAs, these are very serious compromised in terms of security.

In order to protect you from MiTM attack, these certs are included in your distro's list of certificates and explicitly marked as blacklisted/rejected/invalid.

Most distros source the list from the one maintained by Mozilla upstream as part of the nss project.

One example of such a bad cert is the cert(s) issues as part of the Trustwave controversy. Here's the Mozilla issue marking these certs untrusted.

If you look at the mozilla file, you'll see there's an entry called "MITM subCA 1 issued by Trustwave", and it is marked as untrusted.

This and several others example show up as (null) in seahorse because they include enough information for disregarding them, but does not include the actual CA certificate. So, seahorse display them in this strange way.

The 7 entries which correspond to the null certificates are:

  • "MITM subCA 1 issued by Trustwave"
  • "MITM subCA 2 issued by Trustwave"
  • "TURKTRUST Mis-issued Intermediate CA 1"
  • "TURKTRUST Mis-issued Intermediate CA 2"
  • "Distrust: O=Egypt Trust, OU=VeriSign Trust Network (cert 1/3)"
  • "Distrust: O=Egypt Trust, OU=VeriSign Trust Network (cert 2/3)"
  • "Distrust: O=Egypt Trust, OU=VeriSign Trust Network (cert 3/3)"

You can use your favorite search engine to find out more about the stories behind these (also, DigiNotar and Comodo) and to learn how badly broken the CA trust system actually is.

On Fedora the CA cert list (derived from the mozilla file) lives at /usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit).

I've tried reporting this to the seahorse developers on their Gitlab, but gave up after 16 captchas, 30 minutes, and one insta-block.

Links:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.