Christoph Anton Mitterer Reporter
	Description • 10 years ago

Apparently, Firefox, Thunderbird and friends add any certificate they encounter (during browsing, etc.) which is a certificate authority to their CA store, regardless of whether there is a higher level CA which is already trusted(!) or not.

These certs/CAs show up as in the "Sofrware Security Device" and are not trusted(!).


So the issue is not really a security issue, but it completely clutters up the CA store, which all kinds of CAs which aren't trusted anyway:

- either not trusted at all (since they're top-root CA and not trusted) or since they have not higher level CA which is trusted)

- or not explicitly manually marked as being trusted (in the case they have a higher level CA which *is* trusted)


It would be IMHO better if those CAs are not stored permanently, it just clutters up the list and makes CA management much more difficult.
Actually it also leads to one bigger bug, but I'll report that one separately.


Cheers,
Chris.

	:Cykesiopka
	Comment 1 • 9 years ago

Thanks for the report. This is basically a request to fix Bug 733232.