18

Before continuing, please note that I have very little knowledge about or experience with certificates, so this might be completely redundant. Should this be the case, please let me know so that I can delete this question.


A few hours or so ago I stumbled upon a question about a problem with certificates that seemed interesting to me, so I started looking into it. After a while (without figuring out the problem) I went ahead and tried out different data in hopes of reproducing the problem (which is a rather well-known and persistent one).

For this, I had to get a certificate string, which I found in a question, here on Stack Overflow. Now, after generating the certificate using the CertificateFactory I noticed that this certificate includes data like "Full name", "Email address", "Company name" etc., which now has me wondering if that's unintended disclosure of personal data.


TL;DR: Certificate strings found on Stack Overflow can be converted to a full certificate, which happens to contain (always, thus far) at least the full name and the email address. Is that something we need to worry about?

4
  • Do you mean the Common Name, etc? Can you link to the question with the data you're referring to?
    – Machavity Mod
    May 17, 2017 at 12:58
  • Well, these are common settings for an admin to contact in case of an issue with the certificate. This mostly contains company information, like for an Whois request.
    – Tom
    May 17, 2017 at 12:58
  • 7
    I've always honoured requests to redact out HTTP Authorization headers with Basic Auth data, because such data is trivially decoded as base64 to a username and password. If certificate data can equally trivially be turned back into readable contact information, then there might be grounds to scrub that too.
    – Martijn Pieters Mod
    May 17, 2017 at 13:04
  • @MartijnPieters - It is very similar (also base64 encoded) and there are plenty of copy and paste certificate decoders online. I think it is quite likely a beginner might unaware of what information they are actually disclosing because the certificate string looks like gibberish at first glance.
    – Leigh
    May 20, 2017 at 1:04

1 Answer 1

12

I think you're referring to the data contained within the certificate. That data is public and available within the published certificate (signed or not). You could always use it to generate your own certificate request, but you would have to verify domain ownership to have it signed by a Certificate Authority(CA). Without a valid signature, browsers will not trust it.

Here's what Paypal's certificate looks like when you drill down in Firefox (I picked them since they have an EV certificate, and thus fill these fields. Most certs are domain validated and don't contain the data at all)

Now, if someone were to publish their private key, I'd say it needs removal.

2
  • 2
    True, but what about users that create a certificate just for the sake of creating and playing around with it, and - unknowingly - expose things like their full name? I'm not sure if that's an edge-case that we shouldn't worry about too much, or not.
    – Seth
    May 17, 2017 at 13:29
  • 3
    @Seth I'd just warn the user that their info was in their post and leave it at that. I only actively remove things that could be harmful (i.e. API keys, private keys, etc). If someone publishes their name and email, it might not be advisable but it's also not necessarily immediately harmful.
    – Machavity Mod
    May 17, 2017 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .