In a startling revelation, the open-source Mozilla project says that its flagship Firefox browser contains a root certificate authority that doesn’t seem to have a known owner.
It’s quite possible that this could be a legitimate root certificate that changed hands during a merger or some other transaction but the fact that Mozilla’s folks can’t seem to figure out the owner is disconcerting on many levels.
Here’s the disclosure by Kathleen Wilson, who serves as a peer for the “CA certificates module” within the Mozilla project:
“…I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.
Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS.”
A separate bug report identifies the root certificate authority as “RSA Security 1024 V3.”
Interestingly, that root certificate authority is shown as valid in Apple’s System Roots but not in Microsoft’s.
The risk of a root certificate authority without a valid owner can lead to all kinds of trust security issues on the fast-growing browser platform.
Mozilla’s own Gervase Markham is worried about the implications:
That’s rather worrying. Do we know for certain that one or other created it originally? Do we know if it’s in any other root stores other than our own?
The lack of transparency in 2002 re: the source of added roots means we have no idea whether e.g. some malicious actor slipped an extra one into whatever list they were keeping internally to Netscape, and has been MITMing people ever since.
UPDATE: Mozilla now says it has received official word from RSA that they do in fact own the root CA in question. Miscommunication drama.
