Just installed Ubuntu 18.04 LTS, and noticed in Mozilla Firefox 70.0.1 (64-bit), two strange certificates that rang a bell for some reason. Not wanting to trust anywhere on the web for information in case I am being MiTM attacked, can anyone confirm if these two certificates are supposed to be present on a clean install?

  • DigiNotar Root CA
  • DigiNotar PKIoverheid CA Organiste - G2

Pic attached:



Yes, these certificates are supposed to be there, exactly because DigiNotar isn't trustworthy. Let me explain.

The story is a bit convoluted: DigiNotar was a Dutch certification authority. In 2011, people ran across fraudulent certificates that had been issued by DigiNotar. Further examination showed that the company's systems had been cracked and compromised. It's assumed that the attacker's intention was to run a MitM attack on some GMail users in Iran with the fraudulent certificates.

After the breach was detected, the Dutch government took over DigiNotar's operations. A short time later, the company went under. DigiNotar's root certificates were revoked and blocked by Mozilla, Google and so forth.

So, why is Firefox still shipped with DigiNotar certificates? Those are what you might call "blocking certificates". They don't have any trust themselves, so they can't hand down any trust to any other certificates down the chain of trust. Because of that, Firefox won't trust any certificates that say, "Trust me, because DigiNotar signed me". And because the "blocking certificates" are there, no new root certificates for DigiNotar (which would be obviously fraudulent) can be installed, too.

  • 3
    To confirm this, select one of the certs and click "View..."; the cert viewer should say "Could not verify this certificate because it is not trusted" near the top. See this Mozilla security advisory and this security.SE question. – Gordon Davisson Nov 10 '19 at 23:05
  • 5
    Dutch government took over DigiNotar because it was the sole certificate issuer used by almost all of Dutch government and government related businesses, a lot of NGO's and DigiID (==the Dutch National e-ID system). "PKIoverheid" Overheid==government in Dutch. After taking over they quickly invalidated and re-issued all existing certificates and then started to phase them out altogether. Dutch government has a long history of badly dealing with ICT-projects, but this crisis they dealt with relatively well and very quickly. – Tonny Nov 11 '19 at 11:49
  • @Tonny The Dutch government is hardly unique amongst governments in having a long history of badly dealing with ICT-projects! (But yes, they seem to have handled this well.) – Martin Bonner supports Monica Nov 11 '19 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.