Updated: Owner of Firefox's mystery root authority is confirmed

Updated: Owner of Firefox's mystery root authority is confirmed

Summary: In a startling revelation, the open-source Mozilla project says that its flagship Firefox browser contains a root certificate authority that doesn't seem to have a known owner.

SHARE:
TOPICS: Browser
59

Updated: In a startling revelation, the open-source Mozilla project says that its flagship Firefox browser contains a root certificate authority that doesn't seem to have a known owner.

It's quite possible that this could be a legitimate root certificate that changed hands during a merger or some other transaction but the fact that Mozilla's folks can't seem to figure out the owner is disconcerting on many levels.

Here's the disclosure by Kathleen Wilson, who serves as a peer for the "CA certificates module" within the Mozilla project:

"...I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.

Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS."

A separate bug report identifies the root certificate authority as "RSA Security 1024 V3."

Interestingly, that root certificate authority is shown as valid in Apple's System Roots but not in Microsoft's.

The risk of a root certificate authority without a valid owner can lead to all kinds of trust security issues on the fast-growing browser platform.

Mozilla's own Gervase Markham is worried about the implications:follow Ryan  Naraine on twitter

That's rather worrying. Do we know for certain that one or other created it originally? Do we know if it's in any other root stores other than our own?

The lack of transparency in 2002 re: the source of added roots means we have no idea whether e.g. some malicious actor slipped an extra one into whatever list they were keeping internally to Netscape, and has been MITMing people ever since.

UPDATE: Mozilla now says that an official at RSA has confirmed that the root CA authority does belong to RSA.  Miscommunication drama.

UPDATE #2: Here is the official explanation of what happened from Mozilla's Johnathan Nightingale.

Topic: Browser

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

59 comments
Log in or register to join the discussion
  • The certificate can be disabled but not removed

    Editing Firefox's Options or Preferences, drill down through Advanced to Encryption to View Certificates. To disable this iffy certificate, select it, click Edit, uncheck all of the boxes for its trust options, and then OK your way back out.

    Yes, there is a Delete option for certificates. But if you select this iffy cert and delete it, you will find that it has returned after Firefox is closed and run again. The difference is that when the cert returns after having been deleted, its trust option checkboxes will have been cleared--that is, the certificate will have been disabled.

    Or so it appears.

    Mozilla, fix your UI. If you can't or won't do an action we initiate, tell us--and also tell us what you're going to do instead.
    TriangleDoor
    • Remove no problem

      I had no difficulty removing the cert.
      DoubleChill
      • Did you restart?

        As the OP stated, he could delete but the entry was back in the list after a FF restart, although with all trust settings unchecked effectively disabling it.
        Old Techie
  • Potentially *really* bad

    Let's hope that they uncover the rightful owner
    and that this entity turns out to be perfectly
    legitimate.

    If this was an "extra" root cert which was slipped
    in there on purpose, Firefox users have from day
    one been exposed to some really bad risks such as
    spoofing banks etc.
    honeymonster
    • If..

      ..their DNS server was poisoned, yes, that could happen.

      If not, all they have to do is look at the URL bar and make sure it is bank.com and not bank.com.virus.co or something.
      AzuMao
  • RE: Mozilla warns of unknown root certificate authority in Firefox

    It's hard to believe that both Mozilla and Apple would make the same mistake, so it probably is or was a legitimate root certificate. The question is, why can't Mozilla find in their records how the certificate was added?
    steve@...
    • Lack of proper documentation

      "The question is, why can't Mozilla find in their records how the certificate was added?"

      Happens all the time.
      Dr_Zinj
    • Yeah

      I'm sure it's (trust apple) fine. I trust Apple. It's there for my own (trust Apple) good, no doubt.

      :)
      pjdiller
  • RE: Mozilla warns of unknown root certificate authority in Firefox

    so how do we fix this?
    ajaycee
    • Here you go

      <a href=https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=1254>Tutorial from Comodo</a>


      Just go to the "Authorities" tab instead of "Your Certificates"
      AzuMao
      • @AzuMao - Glad to see you...

        are a Comodo supporter!
        Isocrates
        • I'm not, I just figured a firewall company would be trustworthy enough to..

          ..cite.
          AzuMao
  • Turn off trust bits

    fyi:

    https://wiki.mozilla.org/CA:UserCertDB#How_Mozilla_Products_Respond_to_User_Changes_of_Root_Certificates

    [b]"If you delete a cert in your database, one that is also in the trusted list, it may appear to be completely gone, until you restart your program, at which point it will reappear, because it never left the trusted root list. It may reappear in the trusted root list with the trust flags from that list. That's why we tell people that if they want to get rid of a root, the thing to do is NOT to delete it, but rather is to take away all its trust. (The behavior when a cert is deleted has changed a few times over the years.) "[/b]

    General rule to follow: turn off all trust bits.
    Dietrich T. Schmitz, Linux Advocate
  • THE SKY IS FALLING!!!!!!!!!

    run everyone that doesn't understand this!!!
    y2k of ssl ooops.....
    domma
    • The y2k of SSL happened a long time ago.. when a cluster of Linux PS3s..

      ..<a href=http://google.com/search?q=PS3+SSL+crack>cracked the MD5 of a trusted root authority that had EV SSL privileges</a>.
      AzuMao
      • @King of the Sea - Thanks for the...

        info and link.

        However, I do appreciate domma's poke at the
        fearful man or woman who reacts before conducting
        careful, logical research. Now, with the
        revelation that the certificate is legitimate, all
        those who might have removed its trust or,
        possibly, actually deleted the certificate must
        undo their hasty actions.
        Isocrates
        • It gets re-added when you restart Firefox.

          [b] [/b]
          AzuMao
          • True, but it was reported above that the trust will be unselected. [nt]

            [i]nt[/i]
            Isocrates
          • If you unselected it, yes. If you just deleted it, no.

            [b] [/b]
            AzuMao
      • Yes, the article

        http://blogs.zdnet.com/security/?p=2339&tag=nl.e550
        Mahegan