0

Ubuntu for all platforms (laptops+mobiles) must respect and contain Government of India's Root CA and CA Certificates and improve compliance with Indian IT Act 2000 (Cross Certification) and law enforcement rules by including these by default:


Root Certificate 2011

Root Certificate 2007

Other CAs (2011 and 2007):

Any reasons for missing these out on Ubuntu, a globally renowned and acknowledged Operating System from national security,security architecture ... perspectives?

Manually adding these certificates does not make sense for global product like Ubuntu Operating System

Any ETA on any update/upgrade/new release to fix this issue?

2
  • I guess you should contact Canonical.
    – Manuel
    Sep 18, 2013 at 5:43
  • FWIW, U.S. Government root CAs aren't included either. Including any government-controlled root CA would make it trivially easy for that government to spoof websites (anywhere in the world).
    – user187557
    Aug 17, 2021 at 17:42

2 Answers 2

5

Why must Ubuntu respect Indian law?

Mozilla handles the certificate vetting for most Linux distributions (and most applications - even Chrome uses's Mozilla's NSS AFAIK) and they're bundled into ca-certificates along with some Debian infrastructure certificates.

Mozilla is the party that the Indian government has to prove their value to. They've been in this process since at least 2009 but it can take a long time. Here are others in the process.

Root certificate inclusion is a huge deal. It requires a lot of real world verifications, a lot of additional bureaucracy and paperwork and security checks that frankly go a lot further than appeasing the petty demands of a national government.


If you trust a certificate, including it in your install is pretty simple, just don't expect everybody else in the world to trust everything you do. And certainly not on your schedule.

0
1

Ubuntu gets its list of certificates to trust from Debian. Debian gets its list of certificates to trust from Mozilla. Mozilla has processes to ensure that its list of trusted certificates includes only certificates from organisations that are worthy of that trust.

As Oli pointed out, the certificates you want trusted by default are already going through the process to get trusted in Mozilla. If Mozilla approves their inclusion, they will end up trusted in Ubuntu (probably within a release or two).

The process exists to ensure that rogue organisations cannot compromise the security of all users, and that legitimate organisations have adequate procedures and policies in place to make sure that their security and integrity cannot be subverted by third parties.

Ignoring this process could significantly compromise the security of Ubuntu users.

It is not appropriate to bypass this process.

If Mozilla are being unreasonably slow, then an alternative process could be developed for fast-tracking certificates into Ubuntu without compromising users' security. I suppose this might be possible if you can convince Ubuntu developers that this is a good idea. But in the absence of such an alternative process, Ubuntu users will need to wait for Mozilla's approval.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .