1420855 - Remove CA Disig Root R1

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Peter Miskovic]

We want to remove CA Disig Root R1 certificate with subject = CN=CA Disig Root R1, OU=null, O=Disig a.s., C=SK;Certificate Serial Number: 00c3039aee50906e28;
SHA-256 Fingerprint:	
F9:6F:23:F4:C3:E7:9C:07:7A:46:98:8D:5A:F5:90:06:76:A0:F0:39:CB:64:5D:D1:75:49:B2:16:C8:24:40:CE
from  CA Certificate Root Program.

The reason of removing is that this root CA was added to the root store as a possible replacement for CA Disig (sha1RSA) root certificate which expired on March 3, 2016.
At the time of the addition we were not sure for which time the root certificate with sha1RSA signature could be used.
After expiration of CA Disig root we decided not to use this CA Disig Root R1 and its subCA CA Disig R1I1 Certification Services (sha1RSA) for issuing SSL certificates but we used our CA Disig Root R2 (sha256RSA) and its subCA CA Disig R2I2 Certification Service (sha256RSA) for issuing SSL certificates instead.  

There will be no impact on Mozilla users because there is no valid certificate which chain to this root.

Comment 1

[Kathleen Wilson]

Peter, Is there a reason why this bug is marked "Security-Sensitive"?
i.e. Is there a security problem regarding this root certificate?

Does the root certificate need to be removed immediately?

Or can it wait for the next batch of root changes, i.e. January/February time frame?

Comment 2

[Peter Miskovic]

Hi Kathleen,there is no security problem regarding this root certificate.
We don't need it remove immediately and you can remove it with the next batch of root changes.
regards.
Peter

Comment 3

[Kathleen Wilson]

Peter, please edit this bug to uncheck the "Security-Sensitive Crypto Bug" checkbox, which is in the "Security" section near the top of the page.

(I do not have the bug access to change it for you.)