- https://bugzilla.mozilla.org/show_bug.cgi?id=1890898
- https://groups.google.com/a/mozilla.org/g/dev-security-polic...
DigiCert incident was pretty loud so that got my attention too: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322
It's all brown M&Ms here.
Which is the correct course of action:
"Of course. Thank you for paying attention to the spirit of the rule."
Or: "No, fuck you, show is cancelled."
---
All of the stuff I said happened did happen. The extra context you are providing is irrelevant since it does not change the fact that what happened is stupid and it's Mozilla's fault that stupid stuff happened.
It's not a certificate intended for use on the web in general. It's an open finance certificate designed for use within that ecosystem within Brazil, and it was issued to a google subsidiary who would have requested it to have that common name, and who would have been evaluated as being authorised to have such a certificate within that context.
The main problem seems to be that the root certificate was in the MS keystores, and seems to have previously been submitted to mozilla (and maybe others) for inclusion, which points to a poor separation of concerns for that CA. They clearly wanted to be a general web authority at some point, but were repurposed.
So it's hard to see it as purely a "misissuance", and it's definitely not malicious.
But it's not. Microsoft is the only entity that trusts ICP-Brazil. Microsoft cut a deal with Brazil, exclusively regarding software Microsoft controls, to allow them to do... whatever it is they were doing.
You should be unhappy with Microsoft if you're a Microsoft customer. But this has almost nothing to do with the WebPKI. Microsoft could also have rigged their browser up to accomplish the same thing.