523138 - CA list does not contain many U.S. Government root CAs.

Status: RESOLVED INVALID

(CA Program :: CA Certificate Root Program, task)

Description

[John Nagle]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3
Build Identifier: 3.5.3

The United States Department of Defense has a large number of root certificates used on public-facing DoD web sites. Mozilla doesn't have the full list installed.

The Dod root certs have names from
DOD CA-1 
...
DOD CA-26

A typical issuer is:

CN = DOD CA-18
OU = PKI
OU = DoD
O = U.S. Government
C = US

The DoD root certs can be obtained from the Defense Information Systems Agency
at: 

http://dodpki.c3pki.chamb.disa.mil/rootca.html

(although, annoyingly, not over a secure connection). 


Reproducible: Always

Steps to Reproduce:
1. https://forums.af.edu

Actual Results:  
SSL certificate fail popup.

Expected Results:  
Accept certificate.

Comment 1

[John Nagle]

There are a number of Government sites and forums offering workarounds that load some of these certs, but properly, they should be obtained directly from DISA and distributed with Firefox.

Comment 2

[Kathleen Wilson]

Thank you for your interest in including root certificates on Mozilla products. In order to proceed, an official representative of the DoD root certificate program will need to create a request as per https://wiki.mozilla.org/CA:How_to_apply
Only an official repesentative of that organization can provide the information that is necessary to evaluate the root inclusion request.

I have posted a request to the DoD to do this.

I am closing this bug as invalid, because an official representative of that organization will have to create the root inclusion request.