19

I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011.

DigiNotar was a Dutch certificate authority owned by VASCO Data Security International, Inc.1 On September 3, 2011, after it had become clear that a security breach had resulted in the fraudulent issuing of certificates, the Dutch government took over operational management of DigiNotar's systems.[2] That same month, the company was declared bankrupt.[3]

From https://en.wikipedia.org/wiki/DigiNotar

Why is that garbage CA even there?

enter image description here

Improve this question
4
  • You should probably specify which version under which OS. My browser does not have this CA in its trust store, for example.
    – Patrick Mevzek
    Nov 28, 2017 at 0:31
  • 52.5.0 (64-bit) Debian 8.
    – user134969
    Nov 28, 2017 at 0:35
  • 1
    ... notice that it says "... because it is not trusted." ? If you click the "Details" tab, does it have the "Explicitly Distrust DigiNotar Root CA" like in my screenshot below?
    – Mike Ounsworth
    Nov 28, 2017 at 1:51
  • 2
    If you are looking at the 'Servers' tab those are blacklist entries that explicitly DIStrust DigiNotar as opposed to merely omitting it from the trust list; see mozilla.org/en-US/security/advisories/mfsa2011-35 .
    – dave_thompson_085
    Nov 28, 2017 at 3:28

1 Answer 1

Reset to default
25

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button.

The evidence is that it says "Could not verify this certificate because it is not trusted".

As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert would not be trusted is if you open the "Details" tab and see that it's not actually a cert, but some weird Firefox object called Builtin Object Token:Explicitly Distrust DigiNotar Root CA.

Firefox Builtin Object Token:Explicitly Distrust DigiNotar Root CA

Improve this answer
6
  • 2
    There's no CRL for trusted root CAs. So each vendor has to deal with managing untrustworthy certificates in its own way.
    – John Deters
    Nov 28, 2017 at 1:08
  • Even if they explicitly distrust it - why do they still have to ship the certificate?
    – Arminius
    Nov 28, 2017 at 1:12
  • 1
    That's not what I'm seeing in my browser... I have posted a picture in my question...
    – user134969
    Nov 28, 2017 at 1:17
  • 4
    What troubles me is that this CA shows up in the "servers" tab alongside all other manually added exceptions, and there is no "Explicitly Distrust" mentioned in the Details tab. Other browsers list this CA clearly as "UNTRUSTED" in the CA list, not the servers list.
    – Qi Fan
    Jun 15, 2018 at 17:36
  • 1
    In Thunderbird, DigiNotar appears in Servers tab. If we click the entry there is a message "Could not verify this certificate because it has been revoked."
    – Daniel
    Apr 27, 2020 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .