{"id":383,"date":"2008-12-24T12:24:52","date_gmt":"2008-12-24T16:24:52","guid":{"rendered":"http:\/\/benjamin.smedbergs.us\/blog\/?p=383"},"modified":"2008-12-24T14:27:57","modified_gmt":"2008-12-24T18:27:57","slug":"how-to-disable-the-comodo-root-certificate-in-firefox","status":"publish","type":"post","link":"https:\/\/benjamin.smedbergs.us\/blog\/2008-12-24\/how-to-disable-the-comodo-root-certificate-in-firefox\/","title":{"rendered":"How to disable the Comodo reseller root certificate in Firefox"},"content":{"rendered":"

Slashdot is a-buz<\/a>z (and rightly so!) with news that people have been able to obtain an SSL certificate for a domain they don’t own<\/a>, by applying with one of Comodo’s certificate resellers. It is clear that there has been a major breach of trust, but we’re not sure of the best general solution. There has been a discussion in the mozilla.dev.tech.crypto newsgroup<\/a> about what steps Mozilla should take for this breach.<\/p>\n

In the meantime, I recommend disabling the root certificate used by this certificate authority, to avoid the possibility that other fraudulent certificates are floating around in the wild. Here’s how to disable the relevant CA root in Firefox:<\/p>\n

    \n
  1. Open the preferences window\n
  2. Select the “Advanced” tab\n
  3. Select the “Encryption” sub-tab\n
  4. Choose “View Certificates”
    \n \"Firefox<\/p>\n
  5. Find and select the “AddTrust AB \/ AddTrust External CA Root” item\n
  6. Choose the “Edit’ button
    \n \"Root<\/p>\n
  7. Remove all trust setting check-boxes.
    \n \"Edit\n<\/ol>\n

    Note:<\/em> disabling this root certificate will SSL websites validated by this Comodo reseller to stop working. That’s why you’re doing it, but if it’s your favorite website that stops working, please don’t blame me! If you’re really paranoid, you could also disable all Comodo roots: these include all the certificates with names like “AddTrust”, “Comodo CA Limited”, and “The UserTrust Network”.<\/p>\n

    Thanks to Eddy Nigg for first providing<\/a> these instructions.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Slashdot is a-buzz (and rightly so!) with news that people have been able to obtain an SSL certificate for a domain they don’t own, by applying with one of Comodo’s certificate resellers. It is clear that there has been a major breach of trust, but we’re not sure of the best general solution. There has […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,6],"tags":[138,199,64,200],"class_list":["post-383","post","type-post","status-publish","format-standard","hentry","category-mozilla","category-untagged","tag-certificate","tag-comodo","tag-firefox","tag-ssl"],"_links":{"self":[{"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts\/383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/comments?post=383"}],"version-history":[{"count":12,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts\/383\/revisions"}],"predecessor-version":[{"id":398,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/posts\/383\/revisions\/398"}],"wp:attachment":[{"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/media?parent=383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/categories?post=383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/benjamin.smedbergs.us\/blog\/wp-json\/wp\/v2\/tags?post=383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}