Third-party request to remove CNNIC root certificate from NSS

This case is a public request, opened by a third party, asking Mozilla to remove the CNNIC root certificate from NSS. The thread was triggered by user complaints and allegations that CNNIC was not trustworthy, but Mozilla staff repeatedly said Bugzilla was not the place for advocacy and asked for concrete, substantiated evidence of policy violations or misuse. Mozilla stated that CNNIC had previously been reviewed and accepted under Mozilla's CA Certificate Policy and that Mozilla had received reports of possible policy violations that would be investigated if supported by evidence. Kathleen Wilson also clarified that Mozilla does not exclude government-sponsored CAs as a class and later posted instructions for users who wanted to disable trust for a root certificate locally by editing trust bits. The discussion included many public comments, references to the earlier CNNIC inclusion bug, and debate about whether the prior public review had been adequate for users in China. No removal action is recorded in this bug, and the case remained resolved as INCOMPLETE. Newer activity visible in the record consists only of later comments continuing the debate; it does not document a change in Mozilla's decision or the trust status of the CNNIC root in this bug.

1. 2010-01-28 A third party filed a request asking Mozilla to remove the CNNIC root certificate from NSS.
2. 2010-02-04 Mozilla said it had received reports of possible Mozilla CA Certificate Policy violations by CNNIC and asked for substantiated evidence.
3. 2010-02-05 Mozilla clarified that CNNIC had been reviewed and accepted previously and provided links to the information considered during that review.
4. 2010-02-11 Mozilla published instructions for users to disable trust for a root certificate locally by editing trust bits.
5. 2010-06-01 Mozilla noted that Chrome also trusted CNNIC on all platforms.

1. 2010-01-28 Community commenter — The reporter opened the bug and asked Mozilla to remove the CNNIC root certificate from NSS.
2. 2010-01-28 Startcom representative — Eddy Nigg said discussion should occur professionally and asked for evidence rather than advocacy, while pointing to bug 476766 and the mailing list discussion.
3. 2010-01-28 Johnath representative — Johnathan Nightingale said Bugzilla was not a place for advocacy, stated CNNIC had complied with root addition policy, and said concrete evidence such as an impersonating certificate would be needed for action.
4. 2010-02-03 Mozilla representative — Gerv Markham warned participants to follow Bugzilla etiquette and stop posting non-constructive comments.
5. 2010-02-04 Mozilla representative — Kathleen Wilson said Mozilla had received reports of possible policy violations by CNNIC, had previously reviewed and accepted the root, and would investigate substantiated evidence.
6. 2010-02-04 Rossde representative — David E. Ross questioned whether CNNIC's prior statements about its government relationship were accurate and whether the original public review process had been adequate for users in China.
7. 2010-02-05 Mozilla representative — Kathleen Wilson replied that CNNIC was understood to be government sponsored, said that information had been considered during review, and linked the information-gathering document, CPS, audit, and Mozilla policy.
8. 2010-02-05 Startcom representative — Eddy Nigg said the concerns justified reconsideration or review even though he had not found major faults during his earlier review of the application.
9. 2010-02-11 Mozilla representative — Kathleen Wilson posted detailed instructions for disabling trust in a root certificate in Firefox, Thunderbird, and SeaMonkey.
10. 2010-02-19 Community commenter — Gavin Sharp clarified that Mozilla was not asking users to remove the root certificate and that Kathleen's instructions were only for users who chose to do so.
11. 2010-06-01 Mozilla representative — Gerv Markham noted that Chrome also trusted CNNIC on all platforms.