Subject: [perpass] Kazakhstan to MITM all SSL traffic on January 1st, 2016

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 3 Dec 2015 08:43:02 -0500

This is being done via a "national" SSL certificate.

Original post has been taken down, archived version here:
https://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729

Hacker News:
https://news.ycombinator.com/item?id=10663843

Text:
-----
Kazakhtelecom JSC notifies on introduction of National security
certificate from 1 January 2016

>From 1 January 2016 pursuant to the Law of the Republic of Kazakhstan
«On communication» Committee on Communication, Informatization and
Information, Ministry for investments and development of the Republic
of Kazakhstan introduces the national security certificate for
Internet users.

According to the Law telecom operators are obliged to perform traffic
pass with using protocols, that support coding using security
certificate, except traffic, coded by means of cryptographic
information protection on the territory of the Republic of Kazakhstan.

The national security certificate will secure protection of Kazakhstan
users when using coded access protocols to foreign Internet resources.

By words of Nurlan Meirmanov, Managing director on innovations of
Kazakhtelecom JSC, Internet users shall install national security
certificate, which will be available through Kazakhtelecom JSC
internet resources. «User shall enter the site www.telecom.kz and
install this certificate following step by step installation
instructions”- underlined N.Meirmanov.

Kazakhtelecom JSC pays special attention that installation of security
certificate can be performed from each device of a subscriber, from
which Internet access will be performed (mobile telephones and tabs on
base of iOS/Android, PC and notebooks on base of Windows/MacOS).

Detailed instructions for installation of security certificate will be
placed in December 2015 on site www.telecom.kz.

PR department
Kazakhtelecom JSC

30.11.2015
-----

---

From: Eric Burger <[email-masked]>
Date: Thu, 3 Dec 2015 21:12:41 -0500

Government mandated front door for their citizens’ “protection.”

Is this the impetus to fix the root certificate problem? This ‘solution’ is 100% IETF compatible and compliant (!).

> On Dec 3, 2015, at 8:43 AM, Yakov Shafranovich <[email-masked]> wrote:
> 
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Leif Johansson <[email-masked]>
Date: Fri, 4 Dec 2015 18:18:30 +0100

Skickat från min iPhone

> 3 dec. 2015 kl. 14:43 skrev Yakov Shafranovich <[email-masked]>:
> 

You must mean the 'plan to make terminations for benefit glorious nation of Kazakhstan'