Mozilla Root Program

Mozilla Root Program

The Mozilla Root Program governs the inclusion and management of certificate authorities used by Firefox and other Mozilla products. It defines criteria for trust, technical controls, and operational audits for Certificate Authoritys such as DigiCert, Sectigo, Let's Encrypt, and legacy CAs like VeriSign and Thawte. The program interfaces with standards and organizations including IETF, CA/Browser Forum, WebTrust, and European Union Agency for Cybersecurity, shaping how public-key infrastructure (PKI) anchors are trusted across the web.

Overview

The program specifies the root certificate store maintained by Mozilla to validate TLS/SSL, code signing, and S/MIME credentials for services such as Firefox Sync, Thunderbird, and various Android builds that opt into Mozilla's store. Roots are digital certificates issued by entities including GlobalSign, Entrust, and Amazon Trust Services that attest key validity for domains like Google and GitHub or for organizational identities like Microsoft and Apple. Decisions about which roots to include involve stakeholders such as browser vendors, independent auditors like KPMG and Deloitte, and standards bodies like ISO and NIST. Distributions of roots influence interoperability among OpenSSL-based servers, IIS hosts, and Apache HTTP Server deployments.

Policy and Requirements

Mozilla's requirements draw on criteria from the CA/Browser Forum baseline requirements and audit frameworks including WebTrust and ETSI. Applicants must meet organizational controls (e.g., independence, incident response), cryptographic standards (algorithm choices, key lengths), and operational policies such as certificate issuance practices that affect services like Let's Encrypt automated provisioning and legacy enterprise CAs used by Google Workspace or Microsoft 365. The policy covers certificate lifetime limits, revocation mechanisms like OCSP and CRL, and transparency practices such as submission to public logs like Certificate Transparency operated by entities including Google Trust Services and Cloudflare. Security controls reference guidance from NIST Special Publications and industry guidance from OWASP and ENISA.

Root Store Management and Auditing

Operational management uses repository workflows on platforms similar to GitHub for configuration, issue tracking, and community review involving contributors from organizations like Mozilla Foundation, EFF, and independent researchers from universities such as Stanford University and University of Cambridge. Technical auditing requires annual third-party audits performed by firms like BDO and KPMG under standards including WebTrust and ISO/IEC 27001. Audit outcomes inform maintenance actions: key ceremonies, hardware security module use, and cross-checking with public datasets from projects like ZMap and Censys. Transparency is supported through public bug trackers and discussion threads resembling those in Bugzilla and mailing lists similar to IETF working groups.

Inclusion, Distrust, and Removal Processes

The inclusion process begins with an application from a CA such as DigiCert or Entrust and proceeds through technical review, policy compliance checks, and community discussion involving parties like Mozilla Security staff and external reviewers from EFF and security researchers affiliated with University of Michigan or Princeton University. Distrust and removal can occur for causes including misissuance incidents like those that affected Symantec roots, failures to meet audit requirements, legal sanctions from bodies such as U.S. Department of Commerce or European Commission, or evidence of compromise identified by researchers from Google Project Zero or independent vendors like Qualys. When distrust decisions are made, affected software projects coordinate rollback measures across ecosystems like Android, Linux distributions such as Ubuntu, and services run by Amazon Web Services or DigitalOcean.

Impact on Browsers and Ecosystem

Root store decisions affect trust chains for major web properties like YouTube, Facebook, and Wikipedia and have consequences for enterprise systems using Active Directory Certificate Services or OpenLDAP with certificate authentication. Browser vendors including Google Chrome, Apple Safari, and Microsoft Edge maintain their own trust policies but often reference the same incidents and audit findings, causing cross-browser effects when a CA is distrusted. Service operators, hosting providers like Akamai and Fastly, and platform vendors such as Red Hat and Canonical must react to root changes, updating server certificates, implementing intermediate replacements, and adjusting compliance workflows. The program thus plays a central role in web security, influencing operational practices at companies like Cloudflare, Netflix, and Stripe and informing public policy debates involving regulators like European Parliament and national cybersecurity agencies.

Category:Public key infrastructure Category:Mozilla