DigiNotar · Beverwijk, 2011

II

To understand why a company of two hundred people in Beverwijk could do that, you have to look at how the browser's trust is set up, which is cruder than it seems.

When a browser connects to an encrypted site, the site presents it with a certificate — a document that says I am this domain and that is signed by somebody. The browser checks the signature against a list of signers it comes with from the factory, and if it adds up, it paints the padlock.

That list is the matter. The browser and operating system manufacturers bring it; it has of the order of a hundred and some organisations, and in it commercial companies, public administrations and bodies from countries that do not get on with each other all live together.

What is decisive is not how many there are. It is that any one of them can sign a certificate for any domain in the world, and the browser will accept it.

There is no division of competence. There is no register saying that a German bank's domain can only be vouched for by such and such an authority. If a country's certification body decides to issue a certificate for another's mail, that certificate is technically indistinguishable from the legitimate one.

So the security of the whole is not that of the best-run authority; it is that of the worst. Drawn out, that is not a tree of trust, it is a full matrix.

III

What followed the discovery was fast and unusual.

The browser manufacturers removed DigiNotar from their lists within days — which amounts to declaring that everything that company had signed ceased to be worth anything.

And there the Dutch problem appeared. DigiNotar was not only a private company: it was one of the authorities that issued certificates for the administration of the state [town councils, revenue, the vehicle register]. On removing it, a part of the country's public services stopped working.

The Dutch government had to take the company over on 3 September. DigiNotar declared bankruptcy sixteen days later.

The forensic report published months later described an unsegmented internal network, unpatched machines, an antivirus that detected nothing and incomplete logs. The company that vouched for the identity of half the public administration would not have passed an ordinary audit.

DigiNotar was not an isolated case, and that is why it matters. In 2011 another authority, Comodo, had suffered a similar incident months earlier with nine fraudulent certificates. In 2015 a Chinese body issued intermediate certificates that ended up being used to intercept traffic, and it was removed from the lists [CNNIC]. Between 2017 and 2018, Chrome progressively stopped trusting Symantec's certificates, over a long series of badly verified issuances; it was then the largest in the world and it made no difference.

The pattern repeats with an administrative, almost boring regularity. It is discovered, the authority is removed, and the list still has a hundred and some entries because removing one does not change the shape of the problem.

IV

The remedy adopted deserves attention, because it is an explicit acknowledgement that the problem had no fix on the side everybody was looking at.

No attempt was made to stop an authority issuing certificates that were not its business. That would require a central register of who can vouch for what, and setting up that register means deciding who governs it — that argument has never been won on the internet.

What was done was something else: requiring every issuance to be recorded in public append-only logs, which anybody can consult and audit. It is certificate transparency, and since 2018 a large browser rejects certificates that do not appear in those logs.

It is as well to be exact about what it achieves. It does not prevent fraudulent issuance, it makes it visible. The owner of a domain can see that somebody has issued a certificate of theirs, and can see it in minutes instead of months. It is surveillance after the fact and not control before it, and it was chosen because it requires nobody to be in charge. The alternative would have been to create the authority over the authorities, and to that question the internet has answered no since it existed.

V

There remains the part that closes the circle, and it is not reassuring.

In 2015 a free, automated certification authority began operating, set up by a non-profit organisation to solve the problem that encrypting a site cost money and paperwork. It worked extraordinarily well: the proportion of encrypted traffic on the web went from a minority to almost total within a few years.

Today that single organisation issues the certificates of an enormous fraction of the world's sites, including a good part of the public administration of several countries. Its infrastructure is small, its funding is donations and its staff fit in one room.

There is in this no criticism of its operation, which has been impeccable since 2015. There is an observation about the shape: the remedy against an oligopoly of a hundred and some dubious authorities has been a single actor, competent and free, on which a larger part of the web's encryption now depends than depended on any of the previous ones.

The full matrix is still there, and on top of it a single point has been drawn.

There is besides a detail of the calendar worth noting. That authority's certificates expire after ninety days and renew themselves; the automatic procedure is precisely what made encryption cheap. It also means that a long interruption of a single free service would start leaving sites inaccessible within weeks, not years.

It has never happened. The drawing, however, has been made, and it was the remedy that drew it.