Open Bug 2005498 Opened 8 months ago Updated 6 months ago

bundeled cross-signed intermediate certificate "SSL.com TLS Transit ECC CA R2" future

Categories

(NSS :: CA Certificates Code, task)

Tracking

(Not tracked)

People

(Reporter: fkrenzel, Unassigned)

Details

I have a couple of questions regarding the decision to bundle cross-signed intermediate certificate directly to Firefox.
https://bugzilla.mozilla.org/show_bug.cgi?id=1966632

background: Fedora/RHEL systems were affect by the latest ca-certificate update that incorporated the turning off TLS trust bits of some roots change. Users are now unable to connect to services using utilities such as curl, wget,.. really anything that uses crypto libraries that source root certs from ca-certificates.
This also affected python-certifi: https://github.com/certifi/python-certifi/issues/349#issuecomment-2832549577

I don't see an easy fix on ca-certificate site for this. see https://www.fkrenzel.cz/posts/2025-root-ca-mess.html#statement-regarding-ca-certificates-in-fedora-rhel. The best approach now is to contact the service provider. It was also brought to my attention that they might ignore requests from a user of non standard client as opposed to someone using major web-browser such as Firefox.

  1. Was there any public outreach to the CAs and their customers in regard to this? I am concerned about ensuring they eventually fix this on their end, since they aren't that inclined to do so now(it has been 6 moths since and i still see reports about this..).
  2. What is the future policy:
    I expect this becoming more and more occurring and if this approach was to become common, it would require the creation of a intermediate cert store... this in my opinion being against the PKI architecture.
    Shouldn't we be pressuring CAs and subsequent service providers to fix their chains instead?
You need to log in before you can comment on or make changes to this bug.