Editing Firefox's Options or Preferences, drill down through Advanced to Encryption to View Certificates. To disable this iffy certificate, select it, click Edit, uncheck all of the boxes for its trust options, and then OK your way back out.
Yes, there is a Delete option for certificates. But if you select this iffy cert and delete it, you will find that it has returned after Firefox is closed and run again. The difference is that when the cert returns after having been deleted, its trust option checkboxes will have been cleared--that is, the certificate will have been disabled.
Or so it appears.
Mozilla, fix your UI. If you can't or won't do an action we initiate, tell us--and also tell us what you're going to do instead.
Updated: In a startling revelation, the open-source Mozilla project says that its flagship Firefox browser contains a root certificate authority that doesn’t seem to have a known owner.
It’s quite possible that this could be a legitimate root certificate that changed hands during a merger or some other transaction but the fact that Mozilla’s folks can’t seem to figure out the owner is disconcerting on many levels.
Here’s the disclosure by Kathleen Wilson, who serves as a peer for the “CA certificates module” within the Mozilla project:
“…I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.
Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS.”
A separate bug report identifies the root certificate authority as “RSA Security 1024 V3.”
Interestingly, that root certificate authority is shown as valid in Apple’s System Roots but not in Microsoft’s.
The risk of a root certificate authority without a valid owner can lead to all kinds of trust security issues on the fast-growing browser platform.
Mozilla’s own Gervase Markham is worried about the implications:
That’s rather worrying. Do we know for certain that one or other created it originally? Do we know if it’s in any other root stores other than our own?
The lack of transparency in 2002 re: the source of added roots means we have no idea whether e.g. some malicious actor slipped an extra one into whatever list they were keeping internally to Netscape, and has been MITMing people ever since.
UPDATE: Mozilla now says that an official at RSA has confirmed that the root CA authority does belong to RSA. Miscommunication drama.
UPDATE #2: Here is the official explanation of what happened from Mozilla’s Johnathan Nightingale.
