1505899 - November 2018 batch of root CA changes, CA list version 2.30

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task, P1)

Description

[J.C. Jones [:jcj] (he/they)]

November 2018 batch of root CA changes

Comment 1

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1505899 - November 2018 batch of root CA changes r?kwilson

* Add Google Trust Services LLC (GTS) root certificates to NSS
  (bug 1496204)
* Add SHECA UCA Global G2 and UCA EV root certificates to NSS
  (bug 1496214)
* Remove Opentrust and Certplus root certs that currently only have
  the Email trust bit enabled (bug 1499320)
* Remove Certicámara root (bug 1501457)
* Add Certigna Root CA root certificate to NSS (bug 1505614)

Comment 2

[Kathleen Wilson]

I confirm that this patch contains the correct root removals and the correct root additions with the correct trust bit settings.

I will test using the test build here:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=726a71039edcc1e835b2d7bce0f8d514e64c2091

Then I will ask the CAs listed above to perform their testing.

I will update this bug and r+ the patch when all testing has been completed.

Thanks!

Comment 3

[Kathleen Wilson]

Comment on attachment 9023796 [details]
Bug 1505899 - November 2018 batch of root CA changes r?kwilson

I confirm that this patch contains the correct root removals and the correct root additions with the correct trust bit settings. I and the affected CAs have completed our testing of this patch. Thanks!

Comment 4

[J.C. Jones [:jcj] (he/they)]

Thanks, Kathleen. I've landed this as https://hg.mozilla.org/projects/nss/rev/59ef418bf92591c9fb2242f04d362bd029dc7bb2. I will uplift it into Nightly today.

Comment 5

[J.C. Jones [:jcj] (he/they)]

Landed in inbound: https://hg.mozilla.org/integration/mozilla-inbound/rev/3a4a3b9133e99f3a2c86baedd6fc25564aeb4898

Comment 6

[J.C. Jones [:jcj] (he/they)]

Ooops, this was 2.30, as we only use even numbers.