Updated: Owner of Firefox's mystery root authority is confirmed

It's quite possible that this could be a legitimate root certificate that changed hands during a merger or some other transaction but the fact that Mozilla's folks can't seem to figure out the owner is disconcerting on many levels.

Here's the disclosure by Kathleen Wilson, who serves as a peer for the "CA certificates module" within the Mozilla project:

"...I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.

Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS."

A separate bug report identifies the root certificate authority as "RSA Security 1024 V3."

Interestingly, that root certificate authority is shown as valid in Apple's System Roots but not in Microsoft's.

The risk of a root certificate authority without a valid owner can lead to all kinds of trust security issues on the fast-growing browser platform.

Mozilla's own Gervase Markham is worried about the implications:

That's rather worrying. Do we know for certain that one or other created it originally? Do we know if it's in any other root stores other than our own?

The lack of transparency in 2002 re: the source of added roots means we have no idea whether e.g. some malicious actor slipped an extra one into whatever list they were keeping internally to Netscape, and has been MITMing people ever since.

UPDATE: Mozilla now says that an official at RSA has confirmed that the root CA authority does belong to RSA.  Miscommunication drama.

UPDATE #2: Here is the official explanation of what happened from Mozilla's Johnathan Nightingale.