Microsoft is scrambling to block a fraudulent HTTPS certificate that was issued for one of the company's Windows Live Web addresses lest it be used by attackers to mount convincing man-in-the-middle attacks.

The phony Transport Layer Security/Secure Sockets Layer certificate was issued for live.fi and www.live.fi, which are addresses Microsoft reserves for its Windows Live services. The sensitive credential has already been revoked by Comodo, the browser-trusted certificate authority that issued it. But given the ease of defeating the current SSL revocation regimen, attackers may still be able to maliciously use the certificate against unsuspecting end users.

"The purpose of this advisory is to notify customers that an SSL digital certificate was improperly issued," Microsoft officials warned late Monday. "This SSL certificate could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against several Microsoft web properties. It cannot be used to issue other certificates, impersonate other domains, or sign code."

The race to kill all trust in the live.fi certificate is the latest event to underscore the problems with the SSL system, which remains the Internet's de facto method for encrypting sensitive Web traffic and proving the authenticity of servers used for e-mail, banking, and shopping. As security researcher Moxie Marlinspike demonstrated in 2009, revocation lists browsers use to check the validity of TLS certificates are easily defeated. That's because the online certificate status protocol and an earlier database known as certificate revocation lists trigger what's known as a "soft fail" rather than a more secure but also harder-to-tolerate "hard fail." As a result, when an Internet outage makes a revocation list unavailable, most browsers will treat an unvalidated certificate as trusted. Attackers using a CA-issued counterfeit certificate to mount a man-in-the-middle attack can capitalize on this flaw by suppressing revocation response before it reaches a targeted end user.

That means the only sure way to block an improperly issued certificate is for each browser maker to hard-code the revocation into an update. Windows 8 and 8.1 come with an automatic updater of revoked certificates. As the name suggests, the mechanism downloads revoked certificates without requiring users to take any action. An automatic updater is available for Windows 7, Windows Server 2008, and Windows Server 2008 R2, but users are required to install it first. Those using Windows Server 2003, and people who don't have the automatic updater installed, are advised to check this link for an update that can be manually installed.

Google and Mozilla, makers of the Chrome and Firefox browsers, respectively, are likely to issue updates in the next day or two. E-mails sent to officials with both organizations went unanswered as this post was being prepared. Comodo officials also didn't respond to a request for comment.

Easy to issue, hard to kill

The precise circumstances that allowed the fraudulent live.fi certificate to be issued aren't clear, but Microsoft's advisory suggested the forgery was the result of someone obtaining an e-mail address that's typically reserved for website operators to demonstrate their control of a given domain.

"A certificate was improperly issued due to a misconfigured privileged email account on the live.fi domain," Microsoft officials wrote. "An email account was able to be registered for the live.fi domain using a privileged username, which was subsequently used to request an unauthorized certificate for that domain."

This Comodo Web page says such e-mail addresses include those with the words admin, administrator, postmaster, hostmaster, and webmaster immediately to the left of the @ and the domain name for which the certificate is being applied. All it takes for someone to receive a domain-validated TLS certificate is to apply for one using such an address. Comodo will respond with an e-mail that contains a unique validation code and link. Clicking such a link is all the proof Comodo and many other certificate authorities require for proof the applicant is the legitimate owner of the domain.

The ease in obtaining such certificates, and the difficulty in killing them off once they're issued, are potent reminders of the continued insecurity of one of the Internet's most important security mechanisms. Until browser makers declare this credential dead, people visiting any Windows Live domain should remain extra vigilant.