Hacker News Reader

Comment by cagenut | Hacker News Reader

Its not immediately obvious clicking around, who's the CA?

AWS is the CA: https://bugzilla.mozilla.org/show_bug.cgi?id=1172401

EDIT: Just got a cert from the new service. Here's a screenshot of the cert chain. Amazon is issuing them: https://imgur.com/VGos0eY

And just to further clarify - Amazon owns the Starfield root CA as well.

I may be wrong, but it looks like GoDaddy owns Starfield: https://certs.godaddy.com/repository/ (Mozilla inclusion request: https://bugzilla.mozilla.org/show_bug.cgi?id=527056)

Amazon bought one of the Starfield roots from GoDaddy last year: https://mobile.twitter.com/Cryptoki/status/61114541131566694...

Ah, I missed that. Thanks!

tl;dr - For now, their root CA is Starfield[0], but AWS may become a root CA very soon.

Amazon had applied to be a Root Certificate Authority to Mozilla and Android since June 2015 [1]. And it's been in pending for public discussion recently [2], which is one step away from being inclusion by Mozilla[3](aka becoming a root CA).

Once they are vetted and being included in Mozilla's Root CA program, they will be accepted by Firefox browser and on Linux. And after vetted in Android, it will be accepted by Google Chrome/Chromium browsers.[4]

[0] http://i.imgur.com/s2Uijes.png

[1] http://www.geekwire.com/2015/amazon-wants-to-be-your-ssl-cer...

[2] https://mozillacaprogram.secure.force.com/CA/PendingCACertif...

[3] https://wiki.mozilla.org/CA:How_to_apply#Public_discussion

[4] https://www.chromium.org/Home/chromium-security/root-ca-poli...

BTW - The root certs are in the microsoft trust store now.

Cool, they will be accepted as Root Cert on Windows then. Yep, Apple and Microsoft maintains their own Root CA programs (private approval process). I bet AWS also applied for Apple's Root CA program.

Reply on news.ycombinator.com