[tptacek]

The short summary of what's going on here:

The major CAs outsource to partner companies called Registration Authorities (RAs) to perform the task of verifying that people requesting certs are who they say they are --- this is especially important for markets where the company running the CA is has thin on-the-ground support. Such is the case with Symantec/Verisign and CrossCert, their partner RA in Korea.

The technical relationship between the RA and the CA probably varies a lot from firm to firm, but generally the RA has some ability to cause issuance of certificates through automated requests to the CA's infrastructure.

What Ryan and others discovered in repeated rounds of questioning to Symantec was that Symantec had been relying entirely on 3rd party WebTrust audits (these are technical and process audits for CAs conducted by Big 5 accounting firms) without doing any of its own technical due diligence. But the WebTrust audits Symantec's RA's had been doing were delivered by auditors nobody has any faith in, including (as it turns out) Symantec.

Further, Symantec was required to have technical and process controls for specific kinds of issuance requests from their RAs. And it did. But it turned out those controls were designed so that the RAs could override them on their own recognizance. Which is basically the same as running process controls on the honor system --- not OK in this environment.

[bigiain]

Didn't E&Y feature as auditors in the WoSign/StartCom incident as well? Perhaps that decision to only refuse to accept audits from the Hong Kong branch of E&Y wasn't such a great idea...

[MertsA]

Yep, There's now 3 different E&Y subsidiaries that are blacklisted by various parties from carrying out audits.

[tialaramex]

_Some_ major CAs outsource like this. You need this sort of on-the-ground stuff, particularly human employees who can speak the local language and understand local culture, to validate certain subject details, it's not important for the domain validation that most of us care about most of the time. Knowing if the subscriber is really Foo Corp of Shanghai, requires local knowledge, but checking foo-corp-shanghai.example is controlled by the subscriber needs, at the very most, a translated web page of instructions which you can out-source.

It is likely Mozilla policy (or the BRs) will forbid letting the local RA do the domain validation. So, a future CrossCert could lie about whether their subscriber is really Foo Corp, but not about whether they control foo-corp.example

Oh, and it's not the Big Five any more, one of the Five collapsed in scandal because it happily signed off on Enron's obviously bogus accounts. So now we have a Big Four, until another one blows up. For those taking bets, the RA was audited by a local EY, whereas Symantec are audited by a KPMG.