GoDaddy: improperly encoded certificate issued by Go Daddy Secure Certification Authority

This case concerns a certificate encoding problem in a certificate issued by Go Daddy Secure Certification Authority. Mozilla reported that the certificate’s basic constraints extension included the CA boolean value even when it was the default value false, and that this encoding caused mozilla::pkix to terminate the connection. A Go Daddy representative agreed the encoding was invalid and stated that Go Daddy would change its issuing profile to omit the CA basic constraint boolean when false on future certificates. Mozilla noted that this would be a considerable compatibility issue and referenced related mozilla::pkix work in other bugs. The bug was later marked Resolved/Fixed, with Mozilla stating that the underlying issue—GoDaddy’s encoding—had been reported as fixed, while any decision about deprecating the mozilla::pkix workaround might be tracked separately. The thread also discussed the relevant Baseline Requirements and RFC 5280 behavior for basicConstraints encoding.

1. 2014-03-26 Mozilla opened a CA Program compliance bug after identifying an invalid basicConstraints encoding in a Go Daddy Secure Certification Authority-issued certificate.
2. 2014-03-27 Go Daddy agreed the certificate encoding was invalid and discussed the standards basis for the issue.
3. 2014-03-27 Go Daddy committed to changing its issuing profile to omit the CA basic constraint boolean when false on future certificates.
4. 2014-03-28 Mozilla discussed the compatibility impact and pointed to related mozilla::pkix work.
5. 2014-03-29 Mozilla and participants discussed communications and transition time for CAs regarding mozilla::pkix-related findings.
6. 2017-09-20 Mozilla marked the bug Resolved/Fixed after reporting that the underlying GoDaddy encoding issue was fixed.

1. 2014-03-26 Mozilla representative — Created the bug and attachment, stating the basicConstraints CA boolean was encoded as false even though it is the default, which caused mozilla::pkix to terminate the connection.
2. 2014-03-27 Community commenter — Asked for clarification, citing Baseline Requirements and X.690 language about optional/default encodings and suggesting it sounded like a mozilla::pkix bug.
3. 2014-03-27 Community commenter — Corrected the X.690 citation (SET vs SEQUENCE) and concluded the certificate was bad based on the default-value encoding rule.
4. 2014-03-27 GoDaddy — Agreed the encoding was invalid and said Go Daddy would change its issuing profile to omit the CA basic constraint boolean when false on future certificates.
5. 2014-03-28 Mozilla representative — Noted this would be a considerable compatibility issue and referenced prior workaround handling similar to other bugs.
6. 2014-03-28 Mozilla representative — Pointed to separate mozilla::pkix work bugs and stated this bug would track communications and decisions with Go Daddy.
7. 2014-03-29 Mozilla representative — Agreed with the approach and said she would add it to a list of things CAs should stop doing and communicate with CAs with transition time.
8. 2014-03-29 Community commenter — Argued the Baseline Requirements already cover the issue and suggested it was not a new hole but a long-standing requirement.
9. 2014-03-29 Briansmith representative — Agreed broadly and discussed minimizing workaround duration and the existence of stricter decoding in mozilla::pkix.
10. 2017-09-20 Community commenter — Marked the bug Resolved/Fixed, stating the underlying GoDaddy encoding issue was reported fixed, while deprecating the mozilla::pkix workaround might be tracked separately.