A rated company requested that Bitsight create an exception for SSL Certificates signed by an internal Certificate Authority (CA). Best practice dictates that certificates that are publicly available must be signed by a public CA, allowing clients to verify that the site is authentic and in good standing. The rated company appealed on the grounds that some VPN gateway services have been observed with internal CA signed certificates and that these services are only intended to be used by a small number of clients.
The Policy Review Board decided not to implement a change in grading policy at this time. Many VPN services support the use of public CA certificates and recommend their use. A primary argument downplaying the risk of a subset of internal CA certificates is that they are only designed to communicate with a specific set of clients; in such circumstances, it is a best practice to prevent the exposure of such interfaces to the general Internet. Self-signed and internally issued certificates are additionally prone to broad categories of weak implementations that are either less likely to occur or outright prevented by public CA signing policies. A key risk uncovered by the SSL configuration risk vector are devices that are initialized and connected to the Internet, yet are never completely set up or are hardened properly (e.g. may have default credentials). Many such instances manifest as network appliances configured with self-signed or default certificates that are not rooted to a valid trust anchor and not designed to be used in production systems.