Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
What's the purpose of shipping Firefox with expired root certs?
I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the new one needs to be imported manually. Why isn't it immediately shipped with Firefox? Why are the expired certs still included in Firefox?
Trust anchors like root certificates are only trusted because they are included as trusted by the system or browser. There are no additional validations like checking for revocation or expiration. Thus it does not matter much if the root certificate itself is expired but only the expiration dates of the certificates directly or indirectly signed by this root are relevant.
For the validation of the trust chain the public key inside the root certificate is the most important part, because it is needed to validate the signature of the issued certificate. Often you will find multiple versions of the same CA certificate which all share the same public key and subject but which have different expiration dates, signature algorithms or issuers (i.e. some are self-signed, some are signed by another CA). All of these can be used equally as a trust anchor because they share key and subject so it actually does not matter that one has the newest version in the trust store.
I think there is probably less of a technical answer to that. And more of a Mozilla policy answer.
Trust stores have certain rules about how you can get your root CAs into and out of it.
Mozilla also has such rules. I don't completely understand them.
But the general idea is that once your root is inside the Mozilla trust store the regular way you can get thrown out is via a two step process: first your root is left in the trust store, but placed in "deprecated" status. And after your root has been in deprecated status you may then be thrown out completely.
If on the other hand you already have a root CA in the Mozilla trust store and only want to renew it, then the rules are slightly different than if you had no root CAs there. (Not sure about that part.) They have a special section on the wiki named Requests from Already Included CAs that are in or Ready for Discussion -- and A-Trust is listed there.
And what I think is the case here is that "A-Trust" has a root in the store from earlier on but their renewal efforts have not really worked yet. They're still stuck in that process.
Also: While expiration dates may not be a technical reason for exclusion from a trust store, expiration certainly is a reason according to Mozilla policy.
Another reason: Mozilla apps use certificates to verify the digital signatures of extensions (or other stuff you throw at NSSAPI). The signatures should continue to be verifiable long after the signing certificate (and the root certificate of which) expires. The root has to be retained so the CRL/OCSP can still be accessed.
