Root Inclusion in Mozilla

[tlussnig]

https://bugzilla.mozilla.org/show_bug.cgi?id=1289889

Wow this is an great step forward

That mean in the not so far future LetsEncrypt will be in Firefox

[upsuper]

I guess it would end up being included in Firefox 51, which would be the first version released the next year.

[rugk]

As LE announced it will end up in Firefox 50.

However I still have a question about this inclusion now: As it seems X1 has been included, but most of the currently issued certs are issued by X3. Does not that mean only certs issued by X1 will be trusted without Identrust in Firefox 50?

Are there plans to include X3 too?

[tdelmas]

@rugh I think your answer is there:

Where is Let’s Encrypt Authority X3 intermediate certificate by ISRG Root X1?

H…

[tlussnig]

Firefox Nightly “51.0a1 (2016-08-06)” does not yet support the new root.
And the testpage “https://helloworld.letsencrypt.org/” was not updated.

[Osiris]

@rugk

However I still have a question about this inclusion now: As it seems X1 has been included, but most of the currently issued certs are issued by X3. Does not that mean only certs issued by X1 will be trusted without Identrust in Firefox 50?

Are there plans to include X3 too?

Root versus intermediate dude, root versus intermediate..

@tlussnig

And the testpage "https://helloworld.letsencrypt.org/" was not updated.

Updated with what? There isn't a currently active intermediate certificate signed by the ISRG root...

[tlussnig]

@Osiris do you wan’t to say that there is an signed root, but no intermediate that it is usable with these root?

[Osiris]

Correct.   

[kelunik]

Currently, that is correct and also the reason why the helloworld certificate isn’t updated, because it has to chain up to the ISRG root.

[tialaramex]

Strictly, the X1 and X2 intermediate still exist, but Let’s Encrypt policies say it doesn’t issue certificates for end entities (and that’s what helloworld is) except via ACME and the ACME server doesn’t offer certificates from X1 or X2, right now it exclusively delivers certificates signed by X3.

Presumably at some point ISRG will have a signing ceremony, and they will use the ISRG Root (now trusted in Mozilla’s NSS) to sign X3 and X4. Because the ISRG-signed X3 and the IdenTrust-signed X3 are the same public key, with the same Subject DN, you can offer either the IdenTrust certificate (trusted very widely) or the ISRG certificate (only in brand new NSS) as intermediates, although obviously certbot and similar tools would continue to choose IdenTrust because that works better for 99.99% of end users. But helloworld could ask for an X3-signed certificate then, and use the ISRG chain rather than the IdenTrust one if they wanted to.