4 ms·
> Firefox can just ask the root CA to notify them when they issue an intermediate In fact notifying m.d.s.policy is already required whenever such an intermedi
by tialaramex 3y ago
> Firefox can just ask the root CA to notify them when they issue an intermediate
In fact notifying m.d.s.policy is already required whenever such an intermediate is created
5.3.2 "The operator of a CA certificate included in Mozilla’s root store MUST publicly disclose in the CCADB all CA certificates it issues that chain up to that CA certificate trusted in Mozilla’s root store that are technically capable of issuing working server or email certificates,"
- mmsc 3y agoMozilla's root store seems to no longer be relevant. They started to include OS' root stores into Mozilla on all OS' except Linux: https://joshua.hu/mozilla-firefox-trusting-system-root-stores-qwacs-eu https://joshua.hu/mozilla-firefox-trusting-system-root-store...
- aragilar 3y agoThey include CAs that users have added (I'm guessing that information is in the OS root store), not CAs that comes with the OS. This is presumably so that you only need to load your custom CA once to the whole OS, not for each app.
- mmsc 3y agoThat’s not how I’m reading the release information. I don’t have a computer to check this at the moment either:( Edit: oh you’re right! They changed the message in the release information! It was originally “ Firefox now imports TLS trust anchors (e.g., certificates) from the operating system root store.”