5 ms·

Its not immediately obvious clicking around, who's the CA?

by cagenut 11y ago

_alex_ 11y ago
AWS is the CA: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 EDIT: Just got a cert from the new service. Here's a screenshot of the cert chain. Amazon is issuing them: https://imgur.com/VGos0eY https://imgur.com/VGos0eY
- arcdigital 11y ago
  And just to further clarify - Amazon owns the Starfield root CA as well.
  - ehPReth 11y ago
    I may be wrong, but it looks like GoDaddy owns Starfield: https://certs.godaddy.com/repository/ https://certs.godaddy.com/repository/ (Mozilla inclusion request: https://bugzilla.mozilla.org/show_bug.cgi?id=527056 https://bugzilla.mozilla.org/show_bug.cgi?id=527056)
    - grahamedgecombe 11y ago
      Amazon bought one of the Starfield roots from GoDaddy last year: https://mobile.twitter.com/Cryptoki/status/611145411315666944 https://mobile.twitter.com/Cryptoki/status/61114541131566694...
      - ehPReth 11y ago
        Ah, I missed that. Thanks!
devy 11y ago
tl;dr - For now, their root CA is Starfield[0], but AWS may become a root CA very soon. Amazon had applied to be a Root Certificate Authority to Mozilla and Android since June 2015 [1]. And it's been in pending for public discussion recently [2], which is one step away from being inclusion by Mozilla[3](aka becoming a root CA). Once they are vetted and being included in Mozilla's Root CA program, they will be accepted by Firefox browser and on Linux. And after vetted in Android, it will be accepted by Google Chrome/Chromium browsers.[4] [0] http://i.imgur.com/s2Uijes.png http://i.imgur.com/s2Uijes.png [1] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer... [2] https://mozillacaprogram.secure.force.com/CA/PendingCACertificateReport https://mozillacaprogram.secure.force.com/CA/PendingCACertif... [3] https://wiki.mozilla.org/CA:How_to_apply#Public_discussion https://wiki.mozilla.org/CA:How_to_apply#Public_discussion [4] https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
- deleted 11y ago
  [deleted]
- arcdigital 11y ago
  BTW - The root certs are in the microsoft trust store now.
  - devy 11y ago
    Cool, they will be accepted as Root Cert on Windows then. Yep, Apple and Microsoft maintains their own Root CA programs (private approval process). I bet AWS also applied for Apple's Root CA program.

Its not immediately obvious clicking around, who's the CA?

by cagenut 11y ago

Its not immediately obvious clicking around, who's the CA?

AWS is the CA: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 https://bugzilla.mozilla.org/show_bug.cgi?id=1172401 EDIT: Just got a cert from the new service. Here's a screenshot of the cert chain. Amazon is issuing them: https://imgur.com/VGos0eY https://imgur.com/VGos0eY

arcdigital 11y ago
And just to further clarify - Amazon owns the Starfield root CA as well.
- ehPReth 11y ago
  I may be wrong, but it looks like GoDaddy owns Starfield: https://certs.godaddy.com/repository/ https://certs.godaddy.com/repository/ (Mozilla inclusion request: https://bugzilla.mozilla.org/show_bug.cgi?id=527056 https://bugzilla.mozilla.org/show_bug.cgi?id=527056)
  - grahamedgecombe 11y ago
    Amazon bought one of the Starfield roots from GoDaddy last year: https://mobile.twitter.com/Cryptoki/status/611145411315666944 https://mobile.twitter.com/Cryptoki/status/61114541131566694...
    - ehPReth 11y ago
      Ah, I missed that. Thanks!

devy 11y ago

tl;dr - For now, their root CA is Starfield[0], but AWS may become a root CA very soon. Amazon had applied to be a Root Certificate Authority to Mozilla and Android since June 2015 [1]. And it's been in pending for public discussion recently [2], which is one step away from being inclusion by Mozilla[3](aka becoming a root CA). Once they are vetted and being included in Mozilla's Root CA program, they will be accepted by Firefox browser and on Linux. And after vetted in Android, it will be accepted by Google Chrome/Chromium browsers.[4] [0] http://i.imgur.com/s2Uijes.png http://i.imgur.com/s2Uijes.png [1] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-certificate-provider-applies-to-be-a-root-certifcate-authority/ http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer... [2] https://mozillacaprogram.secure.force.com/CA/PendingCACertificateReport https://mozillacaprogram.secure.force.com/CA/PendingCACertif... [3] https://wiki.mozilla.org/CA:How_to_apply#Public_discussion https://wiki.mozilla.org/CA:How_to_apply#Public_discussion [4] https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...

deleted 11y ago
[deleted]
arcdigital 11y ago
BTW - The root certs are in the microsoft trust store now.
- devy 11y ago
  Cool, they will be accepted as Root Cert on Windows then. Yep, Apple and Microsoft maintains their own Root CA programs (private approval process). I bet AWS also applied for Apple's Root CA program.