I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011.

DigiNotar was a Dutch certificate authority owned by VASCO Data Security International, Inc.1 On September 3, 2011, after it had become clear that a security breach had resulted in the fraudulent issuing of certificates, the Dutch government took over operational management of DigiNotar's systems.[2] That same month, the company was declared bankrupt.[3]

From https://en.wikipedia.org/wiki/DigiNotar

Why is that garbage CA even there?

enter image description here

  • You should probably specify which version under which OS. My browser does not have this CA in its trust store, for example. – Patrick Mevzek Nov 28 '17 at 0:31
  • 52.5.0 (64-bit) Debian 8. – user134969 Nov 28 '17 at 0:35
  • 1
    ... notice that it says "... because it is not trusted." ? If you click the "Details" tab, does it have the "Explicitly Distrust DigiNotar Root CA" like in my screenshot below? – Mike Ounsworth Nov 28 '17 at 1:51
  • 2
    If you are looking at the 'Servers' tab those are blacklist entries that explicitly DIStrust DigiNotar as opposed to merely omitting it from the trust list; see mozilla.org/en-US/security/advisories/mfsa2011-35 . – dave_thompson_085 Nov 28 '17 at 3:28

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button.

The evidence is that it says "Could not verify this certificate because it is not trusted".

As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert would not be trusted is if you open the "Details" tab and see that it's not actually a cert, but some weird Firefox object called Builtin Object Token:Explicitly Distrust DigiNotar Root CA.

Firefox Builtin Object Token:Explicitly Distrust DigiNotar Root CA

  • 2
    There's no CRL for trusted root CAs. So each vendor has to deal with managing untrustworthy certificates in its own way. – John Deters Nov 28 '17 at 1:08
  • Even if they explicitly distrust it - why do they still have to ship the certificate? – Arminius Nov 28 '17 at 1:12
  • 1
    That's not what I'm seeing in my browser... I have posted a picture in my question... – user134969 Nov 28 '17 at 1:17
  • 4
    What troubles me is that this CA shows up in the "servers" tab alongside all other manually added exceptions, and there is no "Explicitly Distrust" mentioned in the Details tab. Other browsers list this CA clearly as "UNTRUSTED" in the CA list, not the servers list. – Qi Fan Jun 15 '18 at 17:36
  • 1
    In Thunderbird, DigiNotar appears in Servers tab. If we click the entry there is a message "Could not verify this certificate because it has been revoked." – Daniel Apr 27 '20 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.