Android and Google Chrome will soon stop trusting TrustCor certificates, following Firefox and Edge, over alleged ties to US defense contractor Packet Forensics
Mishaal Rahman / Esper Blog : Thanks: @mishaalrahman
Context & Ripple Effects
Google is completing a browser-consensus move: Firefox and Edge already announced they would stop trusting new TrustCor certificates after reporting tied the certificate authority to US defense contractor Packet Forensics, and Chrome plus Android are now following. For Google this is familiar territory — it has previously dismantled trust in Symantec over mis-issuance and WoSign and StartCom, so TrustCor extends an established playbook from technical breaches to ownership-integrity concerns.
The Android angle raises the stakes beyond desktop browsers, because root-store updates reach phones slowly — as Let's Encrypt's warning about old Android versions losing trust in its root demonstrated. A distrust decision lands unevenly across a device fleet that may not see the update for years.
First-order effects
- Websites and services still chaining to TrustCor certificates will start failing TLS validation in Chrome and on Android devices once the distrust rolls out, forcing those operators to reissue certificates from another authority immediately.
Second-order effects
- Enterprises and hosting providers that provisioned TrustCor certs at scale face migration costs and support load, while every remaining root program now faces pressure to audit its own CAs' ownership structures the way Mozilla's review of TrustCor did.
Third-order effects
- If the pattern holds, root-of-trust decisions consolidate further among a handful of platform vendors whose alignment effectively decides which certificate authorities survive — making CA business viability dependent on passing not just technical audits but ownership scrutiny by Google, Microsoft, and Mozilla.
The trend: Web trust is shifting from per-CA technical audits to platform vendors collectively policing who is allowed to be trusted at all, with ownership ties now a disqualifying criterion.