Mozilla wants to kick Chinese certificate authority (CA) WoSign out of its trust program.
As well as being worried about the certs issued by WoSign, Mozilla accuses the company of buying another CA, StartCom, without telling anyone.
In this lengthy analysis posted to Google Docs, Mozilla says its certificate wonks have "... lost confidence in the ability of WoSign/StartCom to faithfully and competently discharge the functions of a CA."
That investigation follows on from a huge number of issues Mozilla outlines here.
Those issues include WoSign's notorious error of issuing a cert for GitHub to a university student.
The Mozilla engineers' report revolves around SHA-1 certificates. SHA-1 has been regarded as insecure for years and is therefore being deprecated by all major browsers.
As part of its deprecation process, Mozilla treats new SHA-1 certs as invalid unless the issuing CA completes an approval process – and the report says both WoSign and StartCom fudged the process by backdating new SHA-1s to make it seem they were issued before the January 1, 2016 ban.
It accuses WoSign of acquiring Israeli StartCom without disclosing the change of ownership, which “which we believe violates section 5 of the Mozilla CA Certificate Maintenance Policy”.
Although its media release says StartCom remains independent of WoSign, Mozilla says the former is using the latter's infrastructure to issue certs.
As an example of the backdating, Mozilla's investigation documents certificates issued to Australian payments processor Tyro. It nominates a StartCom SHA-1 certificate logged into Google's Certificate Transparency project in June this year, but which Mozilla believes was backdated by StartCom.
The Register has tried to contact Tyro about this certificate.
There's also a smackdown for WoSign's auditors, the Hong Kong office of Ernst & Young, which is says “failed to detect multiple issues they should have detected”.
Mozilla says it wants to “distrust only newly-issued certificates to try and reduce the impact on web users, as both of these CA brands have substantial outstanding certificate corpuses”.
Mozilla is seeking public comment on the issue, in particular to help decide when to implement its proposed ban, and whether WoSign or StartCom need to create new roots before they re-apply to be trusted again.
Interestingly, WoSign issued a media release in China (you'll need Google Translate for this link) at the beginning of last week, announcing it completed its equity investment in StartCom on September 19. ®
