Re: Certificates with shared private keys by gaming software (EA origin, Blizzard battle.net)

2017-12-24 Thread Adrian R. via dev-security-policy

> Bug Blizzard:
> https://bugzilla.mozilla.org/show_bug.cgi?id=1425166
> Cert Blizzard:
> https://crt.sh/?id=26142
> 

Blizzard went to DigiCert and got another certificate instead:

on any computer with BattleNet installed and active go to this url:

https://127.0.0.1:22886/
and currently it uses this certificate... which doesn't appear on crt.sh yet

https://crt.sh/?q=%25localbattle.net


Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0a:7f:ae:52:92:ee:76:c1:f4:f6:56:18:20:f4:ca:e4
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 
High Assurance Server CA
Validity
Not Before: Dec 13 00:00:00 2017 GMT
Not After : Dec 18 12:00:00 2018 GMT
Subject: C=US, ST=California, L=Irvine, O=Blizzard Entertainment, Inc., 
CN=localbattle.net
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:be:e9:0a:c7:46:16:13:9e:d1:a4:e4:ff:5c:cf:
b8:18:43:fb:97:5c:e0:b8:3a:54:c8:3e:63:e1:d1:
7c:9b:fd:9e:52:df:16:80:ca:4b:67:72:dd:cc:0f:
4d:6d:cd:69:0a:8d:46:11:ae:83:93:83:06:ca:0b:
50:e2:3b:85:e4:f8:b6:2b:fd:d7:24:3e:3a:52:05:
10:db:12:d6:f5:a0:6d:af:39:89:f2:0a:b7:7a:52:
3c:6e:a4:2d:cf:7a:9d:9d:c9:2e:95:38:aa:35:ce:
88:5d:78:fc:11:02:b4:d7:c1:9c:84:6c:ab:ad:15:
77:f4:93:59:23:68:f3:85:eb:12:f6:01:ad:a4:d7:
4f:b3:e0:92:45:36:0c:57:94:72:5f:69:bd:f7:2c:
2e:6b:49:e2:d5:24:d4:4d:5e:b8:be:dc:a9:0c:4d:
e4:b4:6b:fb:a8:4f:ca:13:75:ae:a0:79:48:46:96:
a0:86:94:77:83:83:b2:d4:78:1f:c4:5b:c4:25:ee:
9c:85:12:de:8d:4e:d7:67:16:02:de:2a:e2:30:d3:
6b:2f:bc:06:ac:b4:b1:81:8f:be:52:d2:38:73:12:
ad:61:ec:86:93:06:31:55:0b:3e:58:79:a4:aa:57:
42:7e:fc:ba:c1:32:4f:0e:0e:de:10:cf:16:71:ef:
e0:c7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier: 

keyid:51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B

X509v3 Subject Key Identifier: 
E5:3D:10:3F:9D:21:FF:4F:F5:B9:41:F1:A6:A4:4C:29:60:8F:D8:13
X509v3 Subject Alternative Name: 
DNS:localbattle.net, DNS:www.localbattle.net
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Extended Key Usage: 
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 CRL Distribution Points: 

Full Name:
  URI:http://crl3.digicert.com/sha2-ha-server-g6.crl

Full Name:
  URI:http://crl4.digicert.com/sha2-ha-server-g6.crl

X509v3 Certificate Policies: 
Policy: 2.16.840.1.114412.1.1
  CPS: https://www.digicert.com/CPS
Policy: 2.23.140.1.2.2

Authority Information Access: 
OCSP - URI:http://ocsp.digicert.com
CA Issuers - 
URI:http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt

X509v3 Basic Constraints: critical
CA:FALSE
Signature Algorithm: sha256WithRSAEncryption
 68:08:9d:31:38:b3:53:f2:83:a3:1d:d1:77:f0:24:f6:ef:e2:
 19:b1:a3:c2:cb:1c:f7:9f:36:16:84:50:54:17:4e:c5:59:2f:
 c4:d5:b2:ff:ef:40:b3:fb:fa:1d:48:59:85:64:41:60:e3:cc:
 c2:f3:12:60:1b:9f:35:c7:6a:fb:3a:c4:2b:cb:89:53:84:f4:
 cc:8e:bc:e2:9a:b3:56:c3:f0:a4:5c:37:b7:d2:73:71:d4:d9:
 19:27:2b:0f:9f:ff:ed:f0:24:4e:a9:78:61:6f:45:19:3c:96:
 cf:89:1a:a9:7c:2d:d7:d4:7a:d7:9c:71:14:11:8f:b7:6e:63:
 68:1d:af:64:75:eb:1e:5d:ef:e3:d1:a4:9e:d1:69:be:52:8b:
 c2:19:62:75:ca:d5:83:51:77:a7:1e:1d:8b:b7:37:39:1f:36:
 3d:b0:27:8e:2a:47:ce:0d:0a:5d:95:99:75:b4:61:dc:89:62:
 62:0a:07:df:5c:a0:92:e5:4a:2d:dd:c7:ae:6b:03:21:76:1e:
 fb:33:7f:9d:62:c0:ea:dc:34:3b:d3:4a:23:b4:c7:a5:ee:b6:
 6d:ef:80:9d:aa:db:be:3f:71:df:fe:fc:fa:ba:23:a8:c9:7f:
 a1:7a:62:34:42:a5:fe:53:98:b8:52:a8:9a:db:7e:b0:0e:cd:
 c4:d2:f4:92
___
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy


Re: ComSign Root Renewal Request

2017-12-24 Thread YairE via dev-security-policy
Hi Wayne,

as requested i added the file with the certificates issued since 26/10/2014 
until 31/03/2015 to the bug,

Back then it seems we didn’t have a WebTrust audit (I believe we started in 
2015) but only external CPA and governmental audits as are attached already.
The reason we didn’t have a WebTrust audit is that we were already being 
audited by other auditors and the external WebTrust auditor was qualified only 
around that time.
___
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy