Why is Diginotar CA still in my Mozilla Firefox?

Question

I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011.

DigiNotar was a Dutch certificate authority owned by VASCO Data Security International, Inc.1 On September 3, 2011, after it had become clear that a security breach had resulted in the fraudulent issuing of certificates, the Dutch government took over operational management of DigiNotar's systems.[2] That same month, the company was declared bankrupt.

From https://en.wikipedia.org/wiki/DigiNotar

Why is that garbage CAN even there?

Aalap Prabhakaran · Accepted Answer

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button. The evidence is that it says "Could not verify this certificate because it is not trusted". As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert would not be trusted is if you open the "Details" tab and see that it's not actually a cert, but some weird Firefox object called Builtin Object Token:Explicitly Distrust DigiNotar Root CA.

Why is Diginotar CA still in my Mozilla Firefox?

About this question

Your answer

1 Answer

More Cyber Security discussions

Learn & Explore

Cyber Security Tutorials

Cyber Security Interview Q&A

Latest Cyber Security Blogs

Want answers to more Cyber Security questions?

Stay in the loop — it’s free

You’re on the list!