Attacks on Certificate Authorities and Registration Authorities (or resellers)

Comodo provides trusted root certificate authority services in support of the AusCERT CS which services the Australian and New Zealand higher education and research sector.

On 15 September 2011, Comodo released a report called CA Security 2011 - Why PKI still works to update users of PKI services about the security attacks that have affected Certificate Authorities, their resellers, and Registration Authorities, and ultimately, the users who trust and rely on the assurance that digital certificates are intended to provide.

The events described in the report highlight the importance of all parties that have a role to play in managing the certificate life cycle, including RAOs, DRAOs and end users belonging to Participant Organisations, ensuring that they understand the risks, and take appropriate measures to :

• abide by the requirements of the AusCERT Certification Practice and Policy Statement (CPS);
• implement recommended security controls to prevent unauthorised access to the CSM.