3 ms·

Is this the first time a CA has been distrusted for reasons completely unrelated to the security or operations of the CA itself? Reading through Kathleen's sum

Is this the first time a CA has been distrusted for reasons completely unrelated to the security or operations of the CA itself? Reading through Kathleen's summary of the issue[1] that others linked elsewhere in this thread, the only statement relevant to the actual CA portion of TrustCor's business seems to be: > There is no evidence of TrustCor mis-issuing TLS or SMIME certificates. Even the original post says: > Just to restate: I have no evidence that Trustcor has done anything wrong, and I have no evidence that Trustcor has been anything other than a diligent competent certificate authority. So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? If that's true, it seems like a pretty significant departure from previous removals, which all (to my knowledge) involved some sort of action or inaction affecting the security of the CA certificate itself. Is there anything in either Mozilla or Microsoft's root store policies which prohibit CAs from being affiliated with shady companies? Or does this just fall under the "at our sole discretion" clause? [1]: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic...

samb1729 4y ago
> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? The CA representative was presented with the challenge of proving their CA should be trusted, and failed it. This isn't a case of "presumed innocent until proven guilty" as in a criminal trial, so looking at it through that lens isn't very helpful. I think it is reasonable to conclude from Rachel's communications that TrustCor cannot be clearly identified as a trustworthy root CA, and thus they have been removed.
- Ajedi32 4y ago
  Maybe that's a reasonable standard, but if that's what they're using now it's still pretty noteworthy, since like I said I can't recall any instance of a CA being removed for that reason before. In the past there's always been some sort of egregious security issue that calls into question the security of the CA certificate itself.
hamburglar 4y ago
> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? If that's true, it seems like a pretty significant departure from previous removals, which all (to my knowledge) involved some sort of action or inaction affecting the security of the CA certificate itself. A single entity issuing TLS certs and also selling TLS MITM services is pretty obviously an enormous conflict of interest. If this isn’t spelled out explicitly anywhere, it should be.
Jwarder 4y ago
Closest I've seen is when UAE's Darkmatter was revoked as a sub-CA. Darkmatter claimed their "Trust Services" business unit was separate from the business units accused of spying for the UAE government. https://bugzilla.mozilla.org/show_bug.cgi?id=1427262 https://bugzilla.mozilla.org/show_bug.cgi?id=1427262
- Ajedi32 4y ago
  Yeah, now that you mention it I do remember that one. Though I think in that case there were some additional factors at play, like the fact Darkmatter wasn't actually a trusted root CA in the first place (only an intermediate CA, like you said), and had just got caught using insufficient entropy in their certificate serial numbers (which wasn't a huge deal in terms of impact, but was technically still against the baseline requirements).

samb1729 4y ago

> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? The CA representative was presented with the challenge of proving their CA should be trusted, and failed it. This isn't a case of "presumed innocent until proven guilty" as in a criminal trial, so looking at it through that lens isn't very helpful. I think it is reasonable to conclude from Rachel's communications that TrustCor cannot be clearly identified as a trustworthy root CA, and thus they have been removed.

Ajedi32 4y ago
Maybe that's a reasonable standard, but if that's what they're using now it's still pretty noteworthy, since like I said I can't recall any instance of a CA being removed for that reason before. In the past there's always been some sort of egregious security issue that calls into question the security of the CA certificate itself.

hamburglar 4y ago

> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? If that's true, it seems like a pretty significant departure from previous removals, which all (to my knowledge) involved some sort of action or inaction affecting the security of the CA certificate itself. A single entity issuing TLS certs and also selling TLS MITM services is pretty obviously an enormous conflict of interest. If this isn’t spelled out explicitly anywhere, it should be.

Jwarder 4y ago

Closest I've seen is when UAE's Darkmatter was revoked as a sub-CA. Darkmatter claimed their "Trust Services" business unit was separate from the business units accused of spying for the UAE government. https://bugzilla.mozilla.org/show_bug.cgi?id=1427262 https://bugzilla.mozilla.org/show_bug.cgi?id=1427262

Ajedi32 4y ago
Yeah, now that you mention it I do remember that one. Though I think in that case there were some additional factors at play, like the fact Darkmatter wasn't actually a trusted root CA in the first place (only an intermediate CA, like you said), and had just got caught using insufficient entropy in their certificate serial numbers (which wasn't a huge deal in terms of impact, but was technically still against the baseline requirements).