DigiNotar

{{Infobox company

| name = DigiNotar BV

| logo = DigiNotar logo.svg

| caption =

| type = Subsidiary of a publicly traded company

| traded_as =

| genre =

| fate = acquired by VASCO Data Security International, Inc. in 2010; declared bankrupt in 2011

| predecessor =

| successor =

| foundation = {{Start date|1998}}

| founder = Dick Batenburg

| defunct = {{End date|2011|09|20|df=y}}

| location_city = Beverwijk

| location_country = Netherlands

| location =

| locations =

| area_served =

| key_people =

| industry = Internet security

| products = Public key certificates

| services = Certificate authority

| revenue =

| operating_income =

| net_income =

| assets =

| equity =

| owner = VASCO Data Security International

| num_employees =

| parent =

| divisions =

| subsid =

| homepage = {{webarchive |url=https://web.archive.org/web/20080427214400/http://www.diginotar.nl/ |date=27 April 2008 |title=diginotar.nl}}

| footnotes =

| intl =

}}

DigiNotar was a Dutch certificate authority, established in 1998 and acquired in January 2011 by VASCO Data Security International, Inc.{{cite press release |url=http://www.vasco.com/company/press_room/news_archive/2011/acquisition_diginotar.aspx |title=VASCO Data Security International, Inc. announces the acquisition of DigiNotar B.V., a market leader in Internet trust services in the Netherlands |publisher=VASCO |date=January 10, 2011 |access-date=August 31, 2011 |url-status=dead |archive-url=https://web.archive.org/web/20110917092647/http://www.vasco.com/company/press_room/news_archive/2011/acquisition_diginotar.aspx |archive-date=September 17, 2011 |df=mdy-all }}{{Cite journal|last=van der Meulen|first=Nicole|date=June 2013|title=DigiNotar: Dissecting the First Dutch Digital Disaster|journal=Journal of Strategic Security|volume=6|issue=2|pages=46–58|doi=10.5038/1944-0472.6.2.4|issn=1944-0464|doi-access=free}} The company was hacked in June 2011 and it issued hundreds of fake certificates, some of which were used for man-in-the-middle attacks on Iranian Gmail users. The company was declared bankrupt in September 2011.

Overview

On 3 September 2011, after it had become clear that a security breach had resulted in the fraudulent issuing of certificates, the Dutch government took over operational management of DigiNotar's systems.Website Govcert [http://www.govcert.nl/dienstverlening/Kennis+en+publicaties/factsheets/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt.html Factsheet discovery fraudulent certificates] {{Webarchive|url=https://web.archive.org/web/20111008012720/http://www.govcert.nl/dienstverlening/Kennis+en+publicaties/factsheets/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt.html |date=October 8, 2011 }}. Retrieved September 6, 2011. That same month, the company was declared bankrupt.{{cite press release |url=http://www.vasco.com/company/press_room/news_archive/2011/news_vasco_announces_bankruptcy_filing_by_diginotar_bv.aspx |title=VASCO Announces Bankruptcy Filing by DigiNotar B.V. |publisher=VASCO Data Security International |date=September 20, 2011 |access-date=September 20, 2011 |archive-url=https://web.archive.org/web/20110923180445/http://www.vasco.com/company/press_room/news_archive/2011/news_vasco_announces_bankruptcy_filing_by_diginotar_bv.aspx |archive-date=September 23, 2011 |url-status=dead |df=mdy-all }}{{Cite news |last=Wolff |first=Josephine |date=2016-12-21 |title=How a 2011 Hack You've Never Heard of Changed the Internet's Infrastructure |language=en-US |work=Slate |url=https://slate.com/technology/2016/12/how-the-2011-hack-of-diginotar-changed-the-internets-infrastructure.html |access-date=2023-06-30 |issn=1091-2339}}

An investigation into the hacking by Dutch-government appointed Fox-IT consultancy identified 300,000 Iranian Gmail users as the main target of the hack (targeted subsequently using man-in-the-middle attacks), and suspected that the Iranian government was behind the hack. While nobody has been charged with the break-in and compromise of the certificates ({{As of|2013|alt=as of 2013}}), cryptographer Bruce Schneier says the attack may have been "either the work of the NSA, or exploited by the NSA."{{cite web|url=https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html|title=New NSA Leak Shows Man-In-The-Middle Attacks Against Major Internet Services|date=September 13, 2013|access-date=September 14, 2013|archive-date=September 20, 2013|archive-url=https://web.archive.org/web/20130920194737/https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html|url-status=live}} However, this has been disputed, with others saying the NSA had only detected a foreign intelligence service using the fake certificates.{{cite web | url=http://koen.io/2013/09/no-the-nsa-was-not-behind-the-diginotar-hack/ | title=No, the NSA was not behind the DigiNotar hack | date=September 14, 2013 | access-date=November 19, 2013 | author=Rouwhorst, Koen | archive-date=November 20, 2013 | archive-url=https://web.archive.org/web/20131120002024/http://koen.io/2013/09/no-the-nsa-was-not-behind-the-diginotar-hack/ | url-status=live }} The hack has also been claimed by the so-called Comodohacker, allegedly a 21-year-old Iranian student, who also claimed to have hacked four other certificate authorities, including Comodo, a claim found plausible by F-Secure, although not fully explaining how it led to the subsequent "widescale interception of Iranian citizens".{{cite web |url=http://www.pcworld.idg.com.au/article/399812/comodo_hacker_claims_credit_diginotar_attack/ |title=Comodo hacker claims credit for DigiNotar attack |publisher=PC World Australia |date=2011-09-06 |access-date=January 24, 2014 |archive-date=February 2, 2014 |archive-url=https://web.archive.org/web/20140202102259/http://www.pcworld.idg.com.au/article/399812/comodo_hacker_claims_credit_diginotar_attack/ |url-status=live }}

After more than 500 fake DigiNotar certificates were found, major web browser makers reacted by blacklisting all DigiNotar certificates.{{cite web|url=https://arstechnica.com/security/news/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached.ars|title=Comodo hacker: I hacked DigiNotar too; other CAs breached|first=Peter|last=Bright|date=September 6, 2011|website=Ars Technica|access-date=April 29, 2019|archive-date=April 17, 2012|archive-url=https://web.archive.org/web/20120417034405/http://arstechnica.com/security/news/2011/09/comodo-hacker-i-hacked-diginotar-too-other-cas-breached.ars|url-status=live}} The scale of the incident was used by some organizations like

ENISA and AccessNow.org to call for a deeper reform of HTTPS in order to remove the weakest link possibility that a single compromised CA can affect that many users.{{cite news |title=Operation Black Tulip: Certificate authorities lose authority |url=https://www.enisa.europa.eu/media/news-items/operation-black-tulip |work=www.enisa.europa.eu |access-date=January 24, 2014 |archive-date=April 22, 2014 |archive-url=https://web.archive.org/web/20140422203954/http://www.enisa.europa.eu/media/news-items/operation-black-tulip |url-status=live }}{{cite web|url=https://www.accessnow.org/cms/assets/uploads/archive/docs/Weakest_Link_in_the_Chain.pdf|title=The weakest link in the chain: Vulnerabilities in the SSL certificate authority system and what should be done about them. An Access Policy Brief Regarding the Consequences of the DigiNotar breach for Civil Society and Commercial Enterprise|access-date=February 20, 2019|archive-date=October 6, 2018|archive-url=https://web.archive.org/web/20181006021605/https://www.accessnow.org/cms/assets/uploads/archive/docs/Weakest_Link_in_the_Chain.pdf|url-status=live}}

Company

DigiNotar's main activity was as a certificate authority, issuing two types of certificate. First, they issued certificates under their own name (where the root CA was "DigiNotar Root CA").{{cite web |title=Overzicht actuele rootcertificaten |trans-title=Survey of current root certificates |language=nl |url=http://www.diginotar.nl/Klantenservice/Rootcertificaten/tabid/308/Default.aspx |publisher=DigiNotar |access-date=September 12, 2011 |archive-url=https://web.archive.org/web/20110831055843/http://www.diginotar.nl/Klantenservice/Rootcertificaten/tabid/308/Default.aspx |archive-date=August 31, 2011 |url-status=dead |df=mdy-all }} Entrust certificates were not issued since July 2010, but some were still valid up to July 2013.{{cite web |url=http://ssl.entrust.net/blog/?p=946 |title=Entrust in relation with Diginotar |publisher=Ssl.entrust.net |date=2011-09-14 |access-date=February 1, 2012 |archive-url=https://web.archive.org/web/20120402191425/http://ssl.entrust.net/blog/?p=946 |archive-date=April 2, 2012 |url-status=dead |df=mdy-all }}A print screen of a Diginotar certificate under the Entrust chain Secondly, they issued certificates for the Dutch government's PKIoverheid ("PKIgovernment") program. This issuance was via two intermediate certificates, each of which chained up to one of the two "Staat der Nederlanden" root CAs. National and local Dutch authorities and organisations offering services for the government who want to use certificates for secure internet communication can request such a certificate. Some of the most-used electronic services offered by Dutch governments used certificates from DigiNotar. Examples were the authentication infrastructure DigiD and the central car-registration organisation {{ill|Netherlands Vehicle Authority|nl|RDW (Dienst Wegverkeer)}} (RDW).

DigiNotar's root certificates were removed from the trusted-root lists of all major web browsers and consumer operating systems on or around 29 August 2011;{{Cite web|url=https://technet.microsoft.com/library/security/2607712|title=Microsoft Security Advisory 2607712|website=technet.microsoft.com|access-date=2016-06-16|archive-date=June 10, 2016|archive-url=https://web.archive.org/web/20160610040312/https://technet.microsoft.com/library/security/2607712|url-status=live}}{{Cite web|url=https://security.googleblog.com/2011/08/update-on-attempted-man-in-middle.html|title=An update on attempted man-in-the-middle attacks|website=Google Online Security Blog|language=en-US|access-date=2016-06-16|archive-date=June 10, 2016|archive-url=https://web.archive.org/web/20160610024435/https://security.googleblog.com/2011/08/update-on-attempted-man-in-middle.html|url-status=live}}{{Cite web|url=https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/|title=Fraudulent *.google.com Certificate|website=Mozilla Security Blog|access-date=2016-06-16|archive-date=May 25, 2022|archive-url=https://web.archive.org/web/20220525021658/https://blog.mozilla.org/security/2011/08/29/fraudulent-google-com-certificate/|url-status=live}} the "Staat der Nederlanden" roots were initially kept because they were not believed to be compromised. However, they have since been revoked.

= History =

DigiNotar was originally set up in 1998 by the Dutch notary Dick Batenburg from Beverwijk and the {{ill|Koninklijke Notariële Beroepsorganisatie|nl}}, the national body for Dutch civil law notaries. The KNB offers all kind of central services to the notaries, and because many of the services that notaries offer are official legal procedures, security in communications is important. The KNB offered advisory services to their members on how to implement electronic services in their business; one of these activities was offering secure certificates.

Dick Batenburg and the KNB formed the group TTP Notarissen (TTP Notaries), where TTP stands for trusted third party. A notary can become a member of TTP Notarissen if they comply with certain rules. If they comply with additional rules on training and work procedures, they can become an accredited TTP Notary.Website Diginotar on [http://www.diginotar.nl/OverDigiNotar/TTPnotarissen/tabid/318/Default.aspx TTP Notarissen] {{webarchive|url=https://web.archive.org/web/20110831163718/http://www.diginotar.nl/OverDigiNotar/TTPnotarissen/tabid/318/Default.aspx |date=August 31, 2011 }}.

Although DigiNotar had been a general-purpose CA for several years, they still targeted the market for notaries and other professionals.

On 10 January 2011 the company was sold to VASCO Data Security International. In a VASCO press release dated 20 June 2011, one day after DigiNotar first detected an incident on their systems[http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2011/09/05/diginotar-public-report-version-1/rapport-fox-it-operation-black-tulip-v1-0.pdf FOX-IT Interim Report, v1.0] {{Webarchive|url=https://web.archive.org/web/20150421060708/http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2011/09/05/diginotar-public-report-version-1/rapport-fox-it-operation-black-tulip-v1-0.pdf |date=April 21, 2015 }} (but before any certificates were misissued), Timeline, page 13. Retrieved September 5, 2011. VASCO's president and COO Jan Valcke is quoted as stating "We believe that DigiNotar's certificates are among the most reliable in the field."{{cite web|title=VASCO Tackles Global SSL-Certificate Market|url=http://www.marketwatch.com/story/vasco-tackles-global-ssl-certificate-market-2011-06-20?reflink=MW_news_stmp|date=June 20, 2011|website=MarketWatch}}

= Bankruptcy =

On 20 September 2011 Vasco announced that its subsidiary DigiNotar was declared bankrupt after filing for voluntary bankruptcy at the Haarlem court. Effective immediately the court appointed a receiver, a court-appointed trustee who takes over the management of all of DigiNotar's affairs as it proceeds through the bankruptcy process to liquidation.Pressrelease Court of Haarlem on [http://www.rechtspraak.nl/Organisatie/Rechtbanken/Haarlem/Nieuws/Pages/FaillissementDiginotarBV.aspx DigiNotar] {{Webarchive|url=https://web.archive.org/web/20110924072529/http://www.rechtspraak.nl/Organisatie/Rechtbanken/Haarlem/Nieuws/Pages/FaillissementDiginotarBV.aspx |date=September 24, 2011 }}, 20 September 2011. Retrieved September 27, 2011.

= Refusal to publish report =

The curator (court-appointed receiver) didn't want the report from ITSec to be published, as it might lead to additional claims towards DigiNotar.{{citation needed|date=November 2016}} The report covered the way the company operated and details of the hack of 2011 that led to its bankruptcy.{{citation needed|date=November 2016}}

The report was made on request of the Dutch supervisory agency OPTA who refused to publish the report in the first place. In a freedom of information ({{ill|Wet openbaarheid van bestuur|nl}}) procedure started by a journalist, the receiver tried to convince the court not to allow publication of this report, and to confirm the OPTA's initial refusal to do so.Newssite nu.nl: [http://www.nu.nl/diginotar/2842083/curator-diginotar-vreest-meer-claims.html Receiver afraid of more claims] {{Webarchive|url=https://web.archive.org/web/20120630113620/http://www.nu.nl/diginotar/2842083/curator-diginotar-vreest-meer-claims.html |date=June 30, 2012 }} (Dutch), 22 June 2012. Visited: 25 June 2012.

The report was ordered to be released, and was made public in October 2012. It shows a near total compromise of the systems.

Issuance of fraudulent certificates

On 10 July 2011 an attacker with access to DigiNotar's systems issued a wildcard certificate for Google. This certificate was subsequently used by unknown persons in Iran to conduct a man-in-the-middle attack against Google services.{{cite web|url=http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html|title=An update on attempted man-in-the-middle attacks|author=Heather Adkins|date=August 29, 2011|access-date=August 30, 2011|archive-date=September 13, 2011|archive-url=https://web.archive.org/web/20110913024152/http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html|url-status=live}}Elinor Mills. [http://news.cnet.com/8301-27080_3-20098894-245/fraudulent-google-certificate-points-to-internet-attack/ "Fraudulent Google certificate points to Internet attack".] {{Webarchive|url=https://web.archive.org/web/20111008200937/http://news.cnet.com/8301-27080_3-20098894-245/fraudulent-google-certificate-points-to-internet-attack/ |date=October 8, 2011 }} CNET, 8/29/2011. On 28 August 2011 certificate problems were observed on multiple Internet service providers in Iran.{{cite news |author=Charles Arthur |title=Faked web certificate could have been used to attack Iran dissidents |url=https://www.theguardian.com/technology/2011/aug/30/faked-web-certificate-iran-dissidents |newspaper=The Guardian |date=August 30, 2011 |access-date=August 30, 2011 |archive-date=August 26, 2017 |archive-url=https://web.archive.org/web/20170826175742/https://www.theguardian.com/technology/2011/aug/30/faked-web-certificate-iran-dissidents |url-status=live }} The fraudulent certificate was posted on Pastebin.{{cite web|title=Fraudulent certificate triggers blocking from software companies|url=http://h-online.com/-1333088|archive-url=https://web.archive.org/web/20120428161454/http://www.h-online.com/open/news/item/Fraudulent-certificate-triggers-blocking-from-software-companies-1333088.html|archive-date=April 28, 2012 |date=August 30, 2011|publisher=Heise Media UK Ltd.}} According to a subsequent news release by VASCO, DigiNotar had detected an intrusion into its certificate authority infrastructure on 19 July 2011.{{cite web|url=http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx|title=DigiNotar reports security incident|publisher=VASCO Data Security International|date=August 30, 2011|access-date=September 1, 2011|url-status=dead|archive-url=https://web.archive.org/web/20110831143034/http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx|archive-date=August 31, 2011|df=mdy-all}} DigiNotar did not publicly reveal the security breach at the time.

After this certificate was found, DigiNotar belatedly admitted dozens of fraudulent certificates had been created, including certificates for the domains of Yahoo!, Mozilla, WordPress and The Tor Project.{{cite web|url=http://www.nu.nl/internet/2603449/mogelijk-nepsoftware-verspreid-naast-aftappen-gmail.html|title=Mogelijk nepsoftware verspreid naast aftappen Gmail|publisher=Sanoma Media Netherlands groep|date=August 31, 2011|access-date=August 31, 2011|archive-date=December 4, 2011|archive-url=https://web.archive.org/web/20111204192716/http://www.nu.nl/internet/2603449/mogelijk-nepsoftware-verspreid-naast-aftappen-gmail.html|url-status=live}} DigiNotar could not guarantee all such certificates had been revoked.{{cite web|url=http://webwereld.nl/nieuws/107764/diginotar--mogelijk-nog-valse-certificaten-in-omloop.html|publisher=IDG Nederland|title=DigiNotar: mogelijk nog valse certificaten in omloop|date=August 31, 2011|access-date=August 31, 2011|archive-date=February 10, 2012|archive-url=https://web.archive.org/web/20120210140532/http://webwereld.nl/nieuws/107764/diginotar--mogelijk-nog-valse-certificaten-in-omloop.html|url-status=live}} Google blacklisted 247 certificates in Chromium,{{cite web|url=http://www.computerworld.com/s/article/9219663/Hackers_may_have_stolen_over_200_SSL_certificates|title=Hackers may have stolen over 200 SSL certificates|date=August 31, 2011|first=Gregg|last=Keizer|publisher=F-Secure|access-date=September 1, 2011|archive-date=September 3, 2011|archive-url=https://web.archive.org/web/20110903024001/https://www.computerworld.com/s/article/9219663/Hackers_may_have_stolen_over_200_SSL_certificates|url-status=live}} but the final known total of misissued certificates is at least 531.{{cite web|url=http://blog.gerv.net/2011/09/updated-diginotar-cn-list/|title=Updated DigiNotar CN List|date=September 4, 2011|first=Gervase|last=Markham|access-date=September 20, 2011|archive-date=October 21, 2011|archive-url=https://web.archive.org/web/20111021172339/http://blog.gerv.net/2011/09/updated-diginotar-cn-list/|url-status=live}} Investigation by F-Secure also revealed that DigiNotar's website had been defaced by Turkish and Iranian hackers in 2009.{{cite web|url=http://www.f-secure.com/weblog/archives/00002228.html|title=DigiNotar Hacked by Black.Spook and Iranian Hackers|first=Mikko|last=Hypponen|date=August 30, 2011|access-date=August 31, 2011|archive-date=September 25, 2011|archive-url=https://web.archive.org/web/20110925043159/http://www.f-secure.com/weblog/archives/00002228.html|url-status=live}}

In reaction, Mozilla revoked trust in the DigiNotar root certificate in all supported versions of its Firefox browser and Microsoft removed the DigiNotar root certificate from its list of trusted certificates with its browsers on all supported releases of Microsoft Windows.{{cite web |url=http://www.microsoft.com/technet/security/advisory/2607712.mspx |title=Fraudulent Digital Certificates Could Allow Spoofing |date=August 29, 2011 |work=Microsoft Security Advisory (2607712) |publisher=Microsoft |access-date=August 30, 2011}}{{cite web |author=Johnathan Nightingale |url=https://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/ |title=Fraudulent *.google.com Certificate |date=August 29, 2011 |work=Mozilla Security Blog |publisher=Mozilla |access-date=August 30, 2011 |archive-date=September 21, 2011 |archive-url=https://web.archive.org/web/20110921050832/http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/ |url-status=live }} Chromium / Google Chrome was able to detect the fraudulent *.google.com certificate, due to its "certificate pinning" security feature;{{cite web |title=What The DigiNotar Security Breach Means For Qt Users |url=http://www.meegoexperts.com/2011/09/diginotar-security-breach-means-qt-users/ |publisher=MeeGo Experts |date=September 10, 2011 |access-date=September 13, 2011 |archive-url=https://web.archive.org/web/20120324191220/http://www.meegoexperts.com/2011/09/diginotar-security-breach-means-qt-users/ |archive-date=March 24, 2012 |url-status=dead }} however, this protection was limited to Google domains, which resulted in Google removing DigiNotar from its list of trusted certificate issuers. Opera always checks the certificate revocation list of the certificate's issuer and so they initially stated they did not need a security update.{{cite web|url=http://my.opera.com/desktopteam/blog/2011/08/30/opera-11-51-released|title=Opera 11.51 released|date=August 30, 2011|publisher=Opera Software|access-date=September 1, 2011|archive-date=October 5, 2011|archive-url=https://web.archive.org/web/20111005185126/http://my.opera.com/desktopteam/blog/2011/08/30/opera-11-51-released|url-status=live}}{{cite web|url=http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2|title=When Certificate Authorities are Hacked|date=August 30, 2011|first=Sigbjørn|last=Vik|publisher=Opera Software|access-date=September 1, 2011|archive-date=October 8, 2011|archive-url=https://web.archive.org/web/20111008045322/http://my.opera.com/securitygroup/blog/2011/08/30/when-certificate-authorities-are-hacked-2|url-status=live}} However, later they also removed the root from their trust store.{{cite web|url=http://my.opera.com/rootstore/blog/2011/09/08/diginotar-second-step-blacklisting-the-root|title=DigiNotar Second Step: Blacklisting the Root|date=September 8, 2011|publisher=Opera Software|access-date=September 20, 2011|archive-date=November 11, 2011|archive-url=https://web.archive.org/web/20111111203112/http://my.opera.com/rootstore/blog/2011/09/08/diginotar-second-step-blacklisting-the-root|url-status=live}} On 9 September 2011 Apple issued Security Update 2011-005 for Mac OS X 10.6.8 and 10.7.1, which removes DigiNotar from the list of trusted root certificates and EV certificate authorities.{{cite web|url=http://support.apple.com/kb/HT4920|title=About Security Update 2011-005|date=September 9, 2011|publisher=Apple|access-date=September 9, 2011|archive-date=September 25, 2011|archive-url=https://web.archive.org/web/20110925014629/http://support.apple.com/kb/HT4920|url-status=live}} Without this update, Safari and Mac OS X do not detect the certificate's revocation, and users must use the Keychain utility to manually delete the certificate.{{cite web | url=https://arstechnica.com/apple/news/2011/09/safari-users-still-susceptible-to-attacks-using-fake-diginotar-certs.ars | title=Safari users still susceptible to attacks using fake DigiNotar certs | date=September 1, 2011 | website=Ars Technica | access-date=September 1, 2011 | archive-date=October 12, 2011 | archive-url=https://web.archive.org/web/20111012124559/http://arstechnica.com/apple/news/2011/09/safari-users-still-susceptible-to-attacks-using-fake-diginotar-certs.ars | url-status=live }} Apple did not patch iOS until 13 October 2011, with the release of iOS 5.{{cite web | url=http://support.apple.com/kb/HT1222 | title=About the security content of iOS 5 Software Update | date=October 13, 2011 | publisher=Apple | access-date=October 13, 2014 | archive-date=February 5, 2009 | archive-url=https://web.archive.org/web/20090205004031/http://support.apple.com/kb/HT1222 | url-status=live }}

DigiNotar also controlled an intermediate certificate which was used for issuing certificates as part of the Dutch government’s public key infrastructure "PKIoverheid" program, chaining up to the official Dutch government certification authority (Staat der Nederlanden).{{cite web |author=Johnathan Nightingale |title=DigiNotar Removal Follow Up |work=Mozilla Security Blog |url=https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/ |date=September 2, 2011 |access-date=September 4, 2011 |archive-date=September 21, 2011 |archive-url=https://web.archive.org/web/20110921090537/https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/ |url-status=live }} Once this intermediate certificate was revoked or marked as untrusted by browsers, the chain of trust for their certificates was broken, and it was difficult to access services such as the identity management platform DigiD and the Tax and Customs Administration.{{Cite news |last = Schellevis |first = Joost |title = Firefox vertrouwt certificaat DigiD niet meer |newspaper = Tweakers.net |language = nl |date = August 30, 2011 |url = http://tweakers.net/nieuws/76461/firefox-vertrouwt-certificaat-digid-niet-meer.html |access-date = August 30, 2011 |archive-date = September 28, 2011 |archive-url = https://web.archive.org/web/20110928135224/http://tweakers.net/nieuws/76461/firefox-vertrouwt-certificaat-digid-niet-meer.html |url-status = live }} {{ill|GOVCERT.NL|nl}}, the Dutch computer emergency response team, initially did not believe the PKIoverheid certificates had been compromised,{{cite web|url=http://www.govcert.nl/actueel/Nieuws/frauduleus-uitgegeven-beveiligingscertificaat.html|date=August 30, 2011|title=Frauduleus uitgegeven beveiligingscertificaat|access-date=August 31, 2011|archive-date=October 6, 2011|archive-url=https://web.archive.org/web/20111006185750/http://www.govcert.nl/actueel/Nieuws/frauduleus-uitgegeven-beveiligingscertificaat.html|url-status=live}} although security specialists were uncertain.{{Cite news |last = Schellevis |first = Joost |title = Overheid vertrouwt blunderende ssl-autoriteit |newspaper = Tweakers.net |language = nl |date = August 31, 2011 |url = http://tweakers.net/nieuws/76484/overheid-vertrouwt-blunderende-ssl-autoriteit.html |access-date = August 31, 2011 |archive-date = September 28, 2011 |archive-url = https://web.archive.org/web/20110928135333/http://tweakers.net/nieuws/76484/overheid-vertrouwt-blunderende-ssl-autoriteit.html |url-status = live }} Because these certificates were initially thought not to be compromised by the security breach, they were, at the request of the Dutch authorities, kept exempt from the removal of trust{{Cite news |last = Schellevis |first = Joost |title = Firefox vertrouwt DigiD toch na verzoek Nederlandse overheid |newspaper = Tweakers.net |language = nl |date = August 31, 2011 |url = http://tweakers.net/nieuws/76475/firefox-vertrouwt-digid-toch-na-verzoek-nederlandse-overheid.html |access-date = August 31, 2011 |archive-date = September 28, 2011 |archive-url = https://web.archive.org/web/20110928135306/http://tweakers.net/nieuws/76475/firefox-vertrouwt-digid-toch-na-verzoek-nederlandse-overheid.html |url-status = live }} – although one of the two, the active "Staat der Nederlanden - G2" root certificate, was overlooked by the Mozilla engineers and accidentally distrusted in the Firefox build.{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=683449|title=Bugzilla@Mozilla – Bug 683449 - Remove the exemptions for the Staat der Nederlanden root|access-date=September 5, 2011|archive-date=May 2, 2012|archive-url=https://web.archive.org/web/20120502151542/https://bugzilla.mozilla.org/show_bug.cgi?id=683449|url-status=live}} However, this assessment was rescinded after an audit by the Dutch government, and the DigiNotar-controlled intermediates in the "Staat der Nederlanden" hierarchy were also blacklisted by Mozilla in the next security update, and also by other browser manufacturers.{{cite web|url=http://blog.gerv.net/2011/09/diginotar-compromise/|title=DigiNotar Compromise|author=Gervase Markham|author-link=Gervase Markham (programmer)|access-date=September 3, 2011|date=September 3, 2011|archive-date=September 25, 2011|archive-url=https://web.archive.org/web/20110925053958/http://blog.gerv.net/2011/09/diginotar-compromise/|url-status=live}} The Dutch government announced on 3 September 2011 that they would switch to a different firm as certificate authority.{{cite news|title=Security of Dutch government websites in jeopardy|url=http://www.rnw.nl/africa/bulletin/security-dutch-government-websites-jeopardy|publisher=Radio Netherlands Worldwide|date=September 3, 2011|access-date=September 3, 2011|archive-url=https://web.archive.org/web/20110927075509/http://www.rnw.nl/africa/bulletin/security-dutch-government-websites-jeopardy|archive-date=September 27, 2011|url-status=dead|df=mdy-all}}

= Steps taken by the Dutch government =

After the initial claim that the certificates under the DigiNotar-controlled intermediate certificate in the PKIoverheid hierarchy weren't affected, further investigation by an external party, the Fox-IT consultancy, showed evidence of hacker activity on those machines as well. Consequently, the Dutch government decided on 3 September 2011 to withdraw their earlier statement that nothing was wrong.Newsrelease Dutch Government: [http://www.rijksoverheid.nl/nieuws/2011/09/03/overheid-zegt-vertrouwen-in-de-certificaten-van-diginotar-op.html Overheid zegt vertrouwen in de certificaten van Diginotar op] {{Webarchive|url=https://web.archive.org/web/20111017145550/http://www.rijksoverheid.nl/nieuws/2011/09/03/overheid-zegt-vertrouwen-in-de-certificaten-van-diginotar-op.html |date=October 17, 2011 }}, September 3, 2011. Retrieved September 5, 2011. (The Fox-IT investigators dubbed the incident "Operation Black Tulip".{{cite web |last=Charette |first=Robert |url=https://spectrum.ieee.org/diginotar-certificate-authority-breach-crashes-egovernment-in-the-netherlands |title=DigiNotar Certificate Authority Breach Crashes e-Government in the Netherlands - IEEE Spectrum |publisher=IEEE |date=2011-09-09 |access-date=January 24, 2014 |archive-date=February 3, 2014 |archive-url=https://web.archive.org/web/20140203003046/http://spectrum.ieee.org/riskfactor/telecom/security/diginotar-certificate-authority-breach-crashes-egovernment-in-the-netherlands |url-status=live }}) The Fox-IT report identified 300,000 Iranian Gmail accounts as the main victims of the hack.{{cite magazine |author=Gregg Keizer |url=http://www.computerworld.com/s/article/9219731/Hackers_spied_on_300_000_Iranians_using_fake_Google_certificate |title=Hackers spied on 300,000 Iranians using fake Google certificate |magazine=Computerworld |date=2011-09-06 |access-date=January 24, 2014 |archive-date=February 2, 2014 |archive-url=https://web.archive.org/web/20140202161322/http://www.computerworld.com/s/article/9219731/Hackers_spied_on_300_000_Iranians_using_fake_Google_certificate |url-status=live }}

DigiNotar was only one of the available CAs in PKIoverheid, so not all certificates used by the Dutch government under their root were affected. When the Dutch government decided that they had lost their trust in DigiNotar, they took back control over the company's intermediate certificate in order to manage an orderly transition, and they replaced the untrusted certificates with new ones from one of the other providers. The much-used DigiD platform now{{when|date=November 2013}} uses a certificate issued by Getronics PinkRoccade Nederland B.V.See certificate on [https://applicaties.digid.nl/aanvragen Request DigiD account]{{dead link|date=September 2017 |bot=InternetArchiveBot |fix-attempted=yes }}. Retrieved September 5, 2011. According to the Dutch government, DigiNotar gave them its full co-operation with these procedures.

After the removal of trust in DigiNotar, there are now{{when|date=April 2023}} four Certification Service Providers (CSP) that can issue certificates under the PKIoverheid hierarchy:Website Logius:[https://web.archive.org/web/20111228220237/http://www.logius.nl/producten/toegang/pkioverheid/vervangen-certificaten/ Replacing Certificates]. Retrieved September 5, 2011.

:* Digidentity{{Cite web|url=https://www.digidentity.eu/static/nl/digidentity-ssl/pkioverheid-ssl.html|archive-url=https://web.archive.org/web/20120712050404/https://www.digidentity.eu/static/nl/digidentity-ssl/pkioverheid-ssl.html|url-status=dead|title=PKIoverheid SSL|archive-date=July 12, 2012}}

:* ESG or De Electronische Signatuur[http://www.de-electronische-signatuur.nl/web/nl/certificaten/pkioverheid-certificaten/pkioverheid-services-certificaten PKIOverheids certificates] {{webarchive|url=https://web.archive.org/web/20111010072527/http://www.de-electronische-signatuur.nl/web/nl/certificaten/pkioverheid-certificaten/pkioverheid-services-certificaten |date=October 10, 2011 }}. Retrieved September 5, 2011.

:* QuoVadisWebsite Dutch office of Quovadis on [http://www.quovadisglobal.nl/DigitaleCertificaten/PKIOverheidCertificaten.aspx PKIOverheid] {{Webarchive|url=https://web.archive.org/web/20111010041600/http://www.quovadisglobal.nl/DigitaleCertificaten/PKIOverheidCertificaten.aspx |date=October 10, 2011 }}. Retrieved September 5, 2011.

:* KPN Certificatiedienstverlening

All four companies have opened special help desks and/or published information on their websites as to how organisations that have a PKIoverheid certificate from DigiNotar can request a new certificate from one of the remaining four providers.Website Getronics on [http://www.pki.getronics.nl/website/133/ Requesting PKIOverheid certificate] {{webarchive|url=https://archive.today/20111010022710/http://www.pki.getronics.nl/website/133/ |date=October 10, 2011 }}. Retrieved September 5, 2011.

References

External links

[http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/dienstverlening/kennis-en-publicaties/factsheets/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt/govcert%3AdocumentResource%5B2%5D/govcert%3Aresource Fraudulent Certificates ‐ List of Common Names] {{Webarchive|url=https://web.archive.org/web/20111018181357/http://www.govcert.nl/binaries/live/govcert/hst%3Acontent/dienstverlening/kennis-en-publicaties/factsheets/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt/factsheet-frauduleus-uitgegeven-beveiligingscertificaat-ontdekt/govcert%3AdocumentResource%5B2%5D/govcert%3Aresource |date=October 18, 2011 }}
[https://web.archive.org/web/20110831143034/http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx DigiNotar reports security incident]
Pastebin posts:
[http://pastebin.com/ff7Yg663 Gmail.com SSL MITM ATTACK BY Iranian Government -27/8/2011]
[http://pastebin.com/SwCZqskV Internet death sentence for DigiNotar's Root CA!]
[https://www.mozilla.org/security/announce/2011/mfsa2011-34.html Mozilla Foundation Security Advisory 2011-34: Protection against fraudulent DigiNotar certificates]
[https://www.microsoft.com/technet/security/advisory/2607712.mspx Microsoft Security Advisory (2607712): Fraudulent Digital Certificates Could Allow Spoofing]
[http://blog.gerv.net/2011/09/diginotar-compromise/ DigiNotar Compromise] - Mozilla's Gervase Markham's account of how and why Mozilla blacklisted DigiNotar.
{{cite web |author=Johnathan Nightingale |title=DigiNotar Removal Follow Up |work=Mozilla Security Blog |url=https://blog.mozilla.com/security/2011/09/02/diginotar-removal-follow-up/ |date=September 2, 2011 |access-date=September 4, 2011}} Account by the Director of Firefox Engineering at the Mozilla Corporation of why Mozilla's removal of DigiNotar from the trusted list is not a temporary suspension, but a complete revocation of trust.
{{youTube|wZsWoSxxwVYVideo}} by Fox-IT, showing the subsequent OCSP requests by Iranian users of DigiNotar certificates (likely attacks).

Category:Former certificate authorities

Category:Companies established in 1997

Category:Companies disestablished in 2011