Why is Diginotar CA still in my Mozilla Firefox?
I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011.
DigiNotar was a Dutch certificate authority owned by VASCO Data Security International, Inc.1 On September 3, 2011, after it had become clear that a security breach had resulted in the fraudulent issuing of certificates, the Dutch government took over operational management of DigiNotar's systems.[2] That same month, the company was declared bankrupt.
- From https://en.wikipedia.org/wiki/DigiNotar
Why is that garbage CAN even there?
It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button. The evidence is that it says "Could not verify this certificate because it is not trusted". As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert would not be trusted is if you open the "Details" tab and see that it's not actually a cert, but some weird Firefox object called Builtin Object Token:Explicitly Distrust DigiNotar Root CA.