Comment by Ajedi32 | Hacker News Reader

Comment by Ajedi32 | Hacker News Reader

Parent Full thread

Is this the first time a CA has been distrusted for reasons completely unrelated to the security or operations of the CA itself?

Reading through Kathleen's summary of the issue[1] that others linked elsewhere in this thread, the only statement relevant to the actual CA portion of TrustCor's business seems to be:

> There is no evidence of TrustCor mis-issuing TLS or SMIME certificates.

Even the original post says:

> Just to restate: I have no evidence that Trustcor has done anything wrong, and I have no evidence that Trustcor has been anything other than a diligent competent certificate authority.

So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? If that's true, it seems like a pretty significant departure from previous removals, which all (to my knowledge) involved some sort of action or inaction affecting the security of the CA certificate itself.

Is there anything in either Mozilla or Microsoft's root store policies which prohibit CAs from being affiliated with shady companies? Or does this just fall under the "at our sole discretion" clause?

[1]: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

Closest I've seen is when UAE's Darkmatter was revoked as a sub-CA. Darkmatter claimed their "Trust Services" business unit was separate from the business units accused of spying for the UAE government.

https://bugzilla.mozilla.org/show_bug.cgi?id=1427262

Yeah, now that you mention it I do remember that one. Though I think in that case there were some additional factors at play, like the fact Darkmatter wasn't actually a trusted root CA in the first place (only an intermediate CA, like you said), and had just got caught using insufficient entropy in their certificate serial numbers (which wasn't a huge deal in terms of impact, but was technically still against the baseline requirements).

> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception?

The CA representative was presented with the challenge of proving their CA should be trusted, and failed it. This isn't a case of "presumed innocent until proven guilty" as in a criminal trial, so looking at it through that lens isn't very helpful.

I think it is reasonable to conclude from Rachel's communications that TrustCor cannot be clearly identified as a trustworthy root CA, and thus they have been removed.

Maybe that's a reasonable standard, but if that's what they're using now it's still pretty noteworthy, since like I said I can't recall any instance of a CA being removed for that reason before.

In the past there's always been some sort of egregious security issue that calls into question the security of the CA certificate itself.

> So it seems like the sole basis for this action is TrustCor's mere affiliation with another company that does TLS interception? If that's true, it seems like a pretty significant departure from previous removals, which all (to my knowledge) involved some sort of action or inaction affecting the security of the CA certificate itself.

A single entity issuing TLS certs and also selling TLS MITM services is pretty obviously an enormous conflict of interest. If this isn’t spelled out explicitly anywhere, it should be.

Reply on news.ycombinator.com