Trusting Russian Root Certificates and Monitoring Domestic CT Logs
The article examines risks associated with installing Russian root certificates issued by the Ministry of Digital Development. It explains how these certificates, when trusted, enable potential MitM attacks through TSPU infrastructure by allowing on-the-fly issuance of fraudulent certificates for foreign domains. Yandex Browser stands out by enforcing Certificate Transparency checks for domestic certificates, unlike other browsers that disable CT validation in the presence of added roots. Three primary domestic CT logs are maintained by Yandex, VK, and the Ministry, with log lists updated annually. A Python script is provided to query these logs directly and verify SCT inclusion for any certificate. The piece also notes limitations of existing web monitors such as ct.tlscc.ru when dealing with newer log endpoints.
Habr•Policy & Regulation
