Hacker News Reader

Comment by jefftk | Hacker News Reader

Accepted into the root stores for Mozilla, Apple, and Google, but what about Microsoft? (Or maybe Microsoft's doesn't matter anymore with Chrome using their own store since 105, Edge being a Chrome variant, and Firefox always having used their own?)

Though the intermediate cert is cross-signed by GoDaddy, so this isn't a problem right now.

View on HN

I think Microsoft’s Trusted Root Program [1] is still important even with Edge moving to be a Chrome derivative, and it being missing in the announcement is interesting given three other major programs have approved for inclusion.

Inclusion into the trust stores for Linux distributions like Red Hat and Ubuntu will be another interesting one to watch with Certainly.

Oh and the Oracle Java Root Certificate Program [2], since the JRE has its own root certificate store, and Java is still used very broadly.

[1] https://learn.microsoft.com/en-us/security/trusted-root/prog...

[2] https://www.oracle.com/java/technologies/javase/carootcertsp...

Very few people actually manage root programs: Mozilla, Apple, Microsoft, Google, Oracle, and maybe one or two others in smaller niches. Everybody else either uses the platform's store or ships an approximation (the certificate list and some basic constraints, but missing the more complex policies implemented in mozilla::pkix) to Mozilla 's store.

That includes Debian, so probably also Ubuntu. Dunno about Red Hat but it's probably the same.

Microsoft runs a "legal" root program, rather than a "public" root program, meaning if you're included in the Microsoft root store, you sign a legal contract with Microsoft. This is not the case with Google, Mozilla, or Apple. So the process of being included just looks a little different.

Edge still uses the Microsoft root store; Microsoft’s program has been going through some updates recently and they paused processing of new applications while sorting processes. I would guess their application is in but is still under review.

The GoDaddy part also makes this next part marketing speak that technically isn’t true.

> are fully supported by Fastly without any dependence on another organization.

I think their statement is accurate. If they've been accepted into root programs (and it sounds like they have), then the GoDaddy cross-sign is only relevant for older browsers, and even then requires no additional or ongoing actions from GD to keep working.

Is it not dependent on GD keeping upstanding status? If, lets say, they were hacked, and had their status revoked, then the Certainly certs would stop working in some places. That sounds like dependency to me.

In the normal course of events, no. If a CA demonstrates itself to be particularly untrustworthy, the actions most root programs might take (adding restrictions, or removing it from the root store entirely) still rely on those changes getting distributed to users, and if users pick up that update to the root store, they probably picked up the update which added Certainly too.

There are conceivable scenarios where GD doing something (or not doing something) could result in Certainly search no longer validating on some subset of older browsers/clients, but they're quite obscure and unlikely. If you include those scenarios as Certainly having a dependency on GoDaddy, I feel like you would also have to say that Certainly depends on their domain name registrar to not give away their domain out from under them.

Reply on news.ycombinator.com