3

Today I noticed that Firefox 88.0 beta (on macOS) is rejecting TLS certificates for many Portuguese websites – including most government websites – with the error SEC_ERROR_UNKNOWN_ISSUER.

Example sites:

These certificates all have in common that they are issued by Multicert (CN: MULTICERT SSL Certification Authority 001), which is itself certified by Camerfirma (CN: Global Chambersign Root - 2008).

I cannot tell from the error which part of the certificate chain (Multicert or Camerfirma) is "unknown", and nor can I find any information about a revocation online (though I can see that Camerfirma has been plagued with poor security practices for years).

The same websites currently load fine in release versions of Safari and Chrome, as well as Firefox 78.9.0esr.

  • Why is this major European CA "unknown" in current Firefox beta?
  • Has there been a security incident with Multicert or Camerfirma that I should be aware of?
Improve this question
0

1 Answer 1

Reset to default
3

It appears that Camerfirma was revoked from Mozilla Firefox 88:

As many of you have pointed out, there do not appear to be remediation actions that Camerfirma can take at this time to sufficiently reduce the risk of continuing to keep the Websites trust bit enabled for the Camerfirma root certificates. Note that Camerfirma has indicated to us that they are exiting the TLS certificate business.

...

...we intend to turn off the Websites trust bit for the following root certificates in our upcoming batch of changes to Mozilla’s root store, which is expected to happen in Firefox 88

The "..." elision above contains a number of their reasons why, which have a lot in common with the list of poor security practices you've already provided.

Chrome 90 will take the same action.

Improve this answer
5
  • Thank you. Camerfirma's behaviour, and in particular their responses in the linked discussion thread, make for scary reading – and, to be honest, the whole thread reinforces my longstanding scepticism of the reliability of the entire PKI model. That said, I'm surprised and disappointed that this revocation wasn't more widely publicised in advance of making it into (even beta) browser releases. It's not even in the Firefox 88 beta release notes. The messaging on the error page is also pretty poor; no mention is made of "revocation", just that the "certificate issuer is unknown".
    – Caesar
    Apr 2, 2021 at 20:03
  • 3
    It's also quite astounding that governments and major corporations are still using certificates from a CA where a decision to distrust it was made three months ago. Perhaps this reinforces that the messaging was insufficient – or perhaps it's just an example of the usual lack of basic technical literacy on the part of governments and major corporations… (I note that Chrome has decided to postpone their distrust of Camerfirma to allow the Portuguese and Spanish governments even more time to change, given the dangers of preventing access to official health information at this time.)
    – Caesar
    Apr 2, 2021 at 20:07
  • Firefox 78.9.0esr and Chromium 87.0.4280.88 already refuse these certificates (Gentoo).
    – vesperto
    Apr 2, 2021 at 21:09
  • 1
    @vesperto I wonder if they are using the OS's certificate store, and maybe Gentoo has already blocked Camerfirma? On macOS neither of those browser versions rejects the certificates, and Google have said they won't disable them in Chrome stable for at least another couple of weeks, until either v91.0 or possibly a v90 security release.
    – Caesar
    Apr 2, 2021 at 23:29
  • 1
    On Linux it's typical to use Mozilla NSS certificates as the system-wide certificate store, so it is more likely that Gentoo just updated ca-certificates to the latest Moz list including the Camerfirma removal.
    – user1686
    Apr 3, 2021 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .