Mozilla removes inactive RSA root certificate

Mozilla has removed a deserted root certificate authority from its Firefox web browser after initially being unable to determine its current owner.

The root in question was added by RSA several years ago, but when Mozilla recently contacted the company "to confirm current contact and audit information" for the root, RSA was unable to offer details about the status of the root, Johnathan Nightingale, director of Firefox Development, said in a Tuesday blog post.

This prompted some worries among Mozilla developers, who said that VeriSign also could not take ownership of the root. Root certificates are critical parts of browsers, as they are used to sign, or validate, the authenticity of other certificates, such SSL connections used to secure website communications.

"We expect every root in our program to have a clear and active owner, and failing to get that clarity from RSA, we moved to pull this root from the product," Nightingale said. "RSA has since confirmed that this root is no longer needed and can be removed from the product. That clarity, while late, is welcome and confirms our original decision...We regularly check for roots whose audits have lapsed or for whom we don't have an up-to-date point of contact — it's part of keeping our root program healthy."

The root certificate, RSA Security 1024 V3, also appears in Apple's root store. A spokesperson for the computing giant could not be reached for comment on Wednesday.