Edge and Smoothwall cert trust - Potential iceberg ahead?

[HCC]

Hi,

 

I just noticed there is a cert trust change mentioned in the notes of Edge 109 https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-cert-verification. In future versions of Microsoft Edge, both the certificate trust list and the certificate verifier will be provided by and shipped with the browser. This will decouple the list and verifier from the host operating system’s root store.

 

Not sure if the smoothwall cert that we currently deploy by group policy to the OS 'Trusted Root Certification Authorities' won't be trusted by Edge in version 110 unless we disable the microsoftrootstoreenabled setting. But if so that setting will only work until Edge v111 when they then remove it.

 

Might also need to update the instructions soon for students installing the SW cert for guest devices, that use our intercepted guest wireless?

 

It does say In addition to trusting the built-in roots that ship with Microsoft Edge, the browser will also query the underlying platform for—and trust—locally installed roots that users and/or enterprises installed. So I'm not sure if this change is a huge concern or not, but maybe something to be aware of, if like us you use Edge with an filter SSL interception cert on most school devices.

[pete]

Microsoft recommends that enterprises that have break-and-inspect proxies or other scenarios involving TLS server certificates issued by roots not in the Microsoft CTL to proactively test with the policy enabled in Microsoft Edge 109 and report any compatibility issues to Microsoft.

 

In Microsoft Edge 111, we plan to remove support for the MicrosoftRootStoreEnabled policy.

 

So anything that's performing HTTPS interception (transparently or otherwise) will be affected unless Microsoft realises / supplies a workaround.

 

Looks to be linked to an earlier announced change in Chromium: https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html

 

Potentially more info here: Ctrl+F to "Enterprise CA Owners" https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

[sigma]

From the Chrome link https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html

 

The Chrome Certificate Verifier considers locally-managed certificates during the certificate verification process. This means if an enterprise distributes a root CA certificate as trusted to its users (for example, by a Windows Group Policy Object), it will be considered trusted in Chrome.

 

Which is different to how Microsoft say they are handling this for Edge.

[sigma]

Microsoft currently have this schedueled for 9th March for the stable channel.

 

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-release-schedule?source=recommendations

[Fazza]

The BETA is apparently being released during the week of February 14th - how do we get hold of this to test it out to see what happens, can anyone download it or do we have to be part of the BETA program or something?

[k-strider]

the Chrome notes are a little confusing as later on

 

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md#can-you-help_i_m-experiencing-problems

 

Enterprise System Administrators

 

The Chrome Certificate Verifier considers locally-managed certificates during the certificate verification process. Consequently, if an enterprise distributes a root CA certificate as trusted to its users (for example, by a Windows Group Policy Object), it will be considered trusted in Chrome.

 

The Chrome Certificate Verifier evaluates certificate profile conformance against RFC 5280, and in some cases, is more strict than platform verifiers. As a result, an enterprise policy will temporarily be available to re-enable the platform root store and certificate verifier to provide enterprises time to remediate certificate profile conformance errors. See more below.

So its going to be ok (for a bit) or ok i read that both ways and later it says this

 

Can I revert to the platform root store and verifier?

 

The Chrome Certificate Verifier evaluates certificate profile conformance against RFC 5280, and in some cases, is more strict than platform verifiers. The ChromeRootStoreEnabled enterprise policy will be temporarily available to revert to the platform root store and verifier.

 

This enterprise policy is planned to be removed from Windows and macOS beginning in Chrome 113, and should only be used as a temporary solution while troubleshooting and remediating instances of certificate profile conformance issues.

 

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md#can-you-help_i_m-experiencing-problems

[free780]

In Edge you can view the store here.

 

edge://system/#chrome_root_store

 

I can't see any internal root cert but it is trusted.

 

It must be a compare with the OS store.

 

I'm not worried.

[k-strider]

I had to update my ADMX files for Edge to get this

Determines whether the Microsoft Root Store and built-in certificate verifier will be used to verify server certificates (deprecated)

[tom_newton]

One option is of course to move to the in-browser filter extension.

I will make sure we have some good intel on how to maintain MiTM in edge though.

[BOOT]

...Firefox it is.

[CSmith]

Hi all,

 

Just to hopefully put everyone's mind at ease I have done some testing this afternoon with Edge 109 and it appears that everything will continue to work as before, in other words any locally installed CA's should continue to be trusted. A picture is worth a thousand words so here's a screenshot with as much information as I can possibly cram in

 

 

Apologies for the single screenshot but Edugeek complained when I tried to submit my post with several individual screenshots!

 

Hopefully it's clear from the above that I'm testing on Edge 109, and that when the `Microsoft root store` flag is enabled I can still intercept secure sites using the Smoothwall CA I installed into the operating systems certificate store.

 

Here's the relevant quote from the Microsoft site regarding the MicrosoftRootStoreEnabled flag

 

When this policy is set to enabled, Microsoft Edge will perform verification of server certificates using the built-in certificate verifier with the Microsoft Root Store as the source of public trust. When this policy is set to disabled, Microsoft Edge will use the system certificate verifier and system root certificates

 

 

In 109 this flag will be available but disabled by default. In 110 the flag will be enabled by default. In 111 the flag will be removed and the default behaviour will have switched.