If a CA residing in the US began misusing their certificate to MITM TLS connections, I would fully expect Chrome and Firefox to block them too.
> How do we known that they don't share their private keys with the US government?
Certificate Transparency: https://www.certificate-transparency.org/what-is-ct
Of course, CT doesn't prevent website operators from sharing their private keys with third parties, but the discussion here is about CAs, not website operators.
Question for those with a fuller understanding: How can a browser verify this without leaking knowledge about every SSL certificate (and thus a significant percentage of browsing history) they have seen?
Run by VASCO, the certificate was used to issue fraudulent certificates principally in Iran, though the company also issued certificates used by the Dutch government.
The CA was taken over by the Dutch government prior to being shut down entirely in bankruptcy proceedings. Over 10,000 client companies were affected.
VASCO was spun off to the Chicago, USA, based OneSpan.
https://en.wikipedia.org/wiki/DigiNotar
https://en.wikipedia.org/wiki/OneSpan
Browser developers have specific expertise and interest in monitoring CAs, and have developed processes for identifying, resolving, or acting on misuse or abuse which individual systems operators cannot be expected to replicate.
Mozilla doesn't think the state should meddle in your relationship with them, or the rest of the Internet.
> Why don't they also block every CA residing in the US?
Because there's no evidence they're controlled by the US government in the way Kazakhstan's cert clearly is.
I don't want to have a relationship with Mozilla. I use their browser to communicate with other people. The browser is merely a tool, and I would expect it to allow me to communicate with anyone I want (as long as it's technically feasible), not only people that Mozilla approves of.
Installing a cert in the local root store means 'I fully trust the owner of this certificate'. It is an intentional feature of TLS to use this to be able to consensually MitM a TLS connection.
Yet here, western companies have decided that, regardless of whether the user wants to be Man in the Middle -ed by Kazakhstan, they simply cannot. This is inherently a political and not a technical decision. What Kazakhstan is doing is not actually breaking TLS, but instead using a feature.
That could potentially be fixed with better UI, but even then it's rather hard to communicate the danger when the user is under the influence of a social engineering attack from their own ISP. (E.g. "This certificate is needed to ensure your security. Just ignore that warning from your browser, it's not important.)
Incidentally, the above is why the 'consensual MitM-ing through a root-Cert is a feature of TLS' does not hold op. It is not consensual, it is not even coerced, it is a hard requirement. You could then go into an argument about national sovereignty / complying with local laws, but that is a totally different argument.
Look, I'm as pro-freedom as they come and I'm against coercing people to install certificates, but I also think good tools don't leverage their popularity to push their political opinions, even if I agree with those opinions. Good tools allow their user to do whatever is technically possible, even if the tool maker doesn't like that use-case.
The political and personal relationships of the user fall outside the realm of concern of the tool.
I want the browser to let me make my own decisions regarding who I share my encrypted data with.
Hardly sounds like a choice.
If my anyone is coercing me to do something, it's a problem between that person and me. I don't want Mozilla lecturing me on politics, I just want to use the browser.
No one's coercing you into using their browser.
It might be worth considering if this occurred:
Neither do I, but in practice the browsers already do meddle in your relationship with the state: they decided to include that certificate in the first place!
> To protect our users, Firefox, together with Chrome, will block the use of the Kazakhstan root CA certificate. This means that it will not be trusted by Firefox even if the user has installed it.
I don't like this (to be honest, I don't like the whole "certificate authority" thing to begin with).
I don't think my browser should meddle in my relationship with the state.
Why don't they also block every CA residing in the US? The US government coerces companies into giving away private data. How do we known that they don't share their private keys with the US government? Will Mozilla & Google take the blame when this happens? because they've declared themselves the guardians of certificate trust.
What if I legitimately need to install this certificate?