1094451 - Thunderbird lacks the root certificate for Starfield Technologies

Status: RESOLVED INVALID

(Thunderbird :: Untriaged, defect)

Description

[Dave Rado]

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.111 Safari/537.36

Steps to reproduce:

My ISP installs a new SSL certificate once a year. Every time this happens, I have to download the Starfield Technologies root certificate, and then in Thunderbird, I have to go to Tools + Options + Advanced + Certificates, then select "View Certificates", "Authorities", click "Import", and import the Starfield Technologies root certificate file I've downloaded.

Just about every other e-mail client does have that certificate in its list of "trusted roots", as they are called, but not Thunderbird. Please could it be added? This is a lot of unnecessary hassle for your users when it could be fixed by you forever with one simple addition.


Actual results:

What happens is that once a year I get a message saying that my mail server is not trusted. I then have to follow the above completely unnecessary convoluted procedure  simply because unlike every other mail client, Thunderbird doesn't have the Starfield Technologies certificate in its list of "trusted roots".


Expected results:

I should not need to get the above warning message every year and I should not have to manually import the Starfield Technologies certificate when you could and should include it centrally.

Comment 1

[Matthias Versen [:Matti]]

You as user can not request that a root should be included, only the CA can do that.
see https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/inclusion/

Comment 2

[Dave Rado]

It seems strange that every other email client has Starfield listed but bout yours. What email address should I contact at Starfield in order to ask them to apply to you to have it added?

Comment 3

[Matthias Versen [:Matti]]

It's not that strange that all other email clients have that certificate included. They are only 3 big certificate stores used as far as I know: Mozilla, Microsoft, Apple
Most Windows email clients are using the Microsoft certificate store

Comment 4

[Dave Rado]

You didn't answer my question.

Comment 5

[Matthias Versen [:Matti]]

I do not know who is responsible at Starfield.
Mozilla already includes a Startfield root Certificate so either they are using a different one in for signing your emails, the root certificate in Mozilla doesn't include email or what you have to import is an intermediate certificate because Gecko currently doesn't support the automatic download of intermediate certificates.