4 ms·
I see nothing wrong with Firefox's behavior in this case. Root CA certificates are just certificates that the issuer paid and lobbied to include into the browse
by rgbrenner 3y ago
I see nothing wrong with Firefox's behavior in this case. Root CA certificates are just certificates that the issuer paid and lobbied to include into the browser's certificate store, and they agreed to rules about what they can and cannot do (to maintain trustworthiness).
The root CA then just signs a certificate for the intermediate (allowing them to issue certificates), and required the intermediate to contractually agree to the same rules... because if the intermediate violates the rules, the root CA and all intermediates would be removed from the browser.
Other than the contractual relationship between the parties, there's no difference between an intermediate CA and a root CA. Including an intermediate certificate in the store, makes it equivalent to the root certificate (which is a certificate that is trusted only because it is included in the browser's store).
The only downside to this I can see is that it creates more work to maintain the certificate store. Firefox can just ask the root CA to notify them when they issue an intermediate.. it isnt like this happens every day.
- tialaramex 3y ago> Firefox can just ask the root CA to notify them when they issue an intermediate In fact notifying m.d.s.policy is already required whenever such an intermediate is created 5.3.2 "The operator of a CA certificate included in Mozilla’s root store MUST publicly disclose in the CCADB all CA certificates it issues that chain up to that CA certificate trusted in Mozilla’s root store that are technically capable of issuing working server or email certificates,"
- mmsc 3y agoMozilla's root store seems to no longer be relevant. They started to include OS' root stores into Mozilla on all OS' except Linux: https://joshua.hu/mozilla-firefox-trusting-system-root-stores-qwacs-eu https://joshua.hu/mozilla-firefox-trusting-system-root-store...
- aragilar 3y agoThey include CAs that users have added (I'm guessing that information is in the OS root store), not CAs that comes with the OS. This is presumably so that you only need to load your custom CA once to the whole OS, not for each app.
- mmsc 3y agoThat’s not how I’m reading the release information. I don’t have a computer to check this at the moment either:( Edit: oh you’re right! They changed the message in the release information! It was originally “ Firefox now imports TLS trust anchors (e.g., certificates) from the operating system root store.”