13

Some OSS projects include CA certificates and claims that they are subject to a particular OSS license. For example the certificates in https://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt are said to be "subject to the terms of the Mozilla Public License, v. 2.0."

However the certs themselves are mere large random numbers, which are "mechanically generated" and not "an original expression of an idea". Hence they might be considered as not copyrightable, and hence the OSS license cannot be applied.

Is that a reasonable interpretation?

  • 4
    I think that just because each certificate is not copyrightable doesn't necessarily mean that a collection of them also isn't copyrightable. – svick Jun 24 '15 at 18:21
3

A certificate is not a creative work. It is a strictly codified representation of a piece of information. Copyright does not apply.

In some jurisdictions, there is a form of copyright for databases, i.e. collections of items which on their own may not be (and usually are not) subject to copyright. This is sometimes known as database right.

In US law, database right is distinct from copyright, and databases are not legally protected — anyone can copy them. In the EU, databases are legally protected.

At the European Union level, the database directive declares that collections that are an “intellectual creation” where the author made a selection are protected by copyright (but with somewhat different rules for the European equivalent of fair use). Mozilla's list of CA certificates falls under this category. Databases that aim to be complete are protected by a distinct database right.

Thus you can legally ignore any licensing terms if you obtain the Mozilla CA certificate database in a US jurisdiction. If you obtain it in an EU jurisdiction, Mozilla is entitled to prevent you from redistributing the database. They could restrict who had access to the database by not allowing everybody on the Internet to download it, if they so wanted. Since the database is provided with a license notice, if you download it, you are entitled to deal with the database only in ways that are allowed by this license. In other jurisdictions, consult the applicable laws.

0

While the random numbers can't be copyrighted, the use in which they were intended can.

Example

For example someone might copyright a piece of text: "Hello my name is Trevor". While you can't use those words as me or in my place, someone by the name of Trevor is still allowed to use those words in that order.

Conclusion

Nobody can take those numbers and use them as CA Certificates. However, you can still use those numbers in that order, as long as you're not using the number for the purpose used on that page.

  • 2
    Where are you getting that? Copyright covers a form of expression, not a “use in which they were intended”. Copyright covers any creative work; the copyright status of “Hello my name is Trevor” does not depend on the name of the persons involved. (It can depend on context, e.g. the reuse of character names from a work of fiction can be copyright infringement in some circumstances, but that's a different matter and not relevant here.) – Gilles 'SO- stop being evil' Jun 25 '15 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.