1574670 - Remove Expired root certificates - Class 2 Primary, UTN-USERFirst-Client, Deutsche Telekom Root CA 2

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task, P1)

Description

[Kathleen Wilson]

The following root certificates have expired, so can be removed from NSS.

CN = Class 2 Primary CA
SHA-256 Fingerprint: 0F993C8AEF97BAAF5687140ED59AD1821BB4AFACF0AA9A58B5D57A338A3AFBCB
SHA-1 Fingerprint: 74207441729CDD92EC7931D823108DC28192E2BB
Trust Bits: Email, Websites
Expired on: 7/6/2019
Not EV
Related Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1465629

CN = UTN-USERFirst-Client Authentication and Email
SHA-256 Fingerprint: 43F257412D440D627476974F877DA8F1FC2444565A367AE60EDDC27A412531AE
SHA-1 Fingerprint: B172B1A56D95F91FE50287E14D37EA6A4463768A
Trust Bits: Email
Expired on: 7/9/2019

CN = Deutsche Telekom Root CA 2
SHA-256 Fingerprint: B6191A50D0C3977F7DA99BCDAAC86A227DAEB9679EC70BA3B0C9D92271C170D3
SHA-1 Fingerprint: 85A408C09C193E5D51587DCDD61330FD8CDE37BF
Trust Bits: Email, Websites
Expired on: 7/9/2019
Not EV

Comment 1

[Kathleen Wilson]

Remi, Please confirm that DocuSign is ready for the expired "Class 2 Primary CA" to be removed from Mozilla's Root Store (NSS).

Comment 2

[Kathleen Wilson]

Rob, Please confirm that Sectigo is ready for the expired "UTN-USERFirst-Client Authentication and Email" root to be removed from Mozilla's Root Store.

Comment 3

[J.C. Jones [:jcj] (he/him)]

Marcus, take this one - we'll land the patch after we get confirmation for the above needinfos (comment 1, comment 2)

Comment 4

[Kathleen Wilson]

Arnold, Please confirm that T-Systems is ready for the expired "Deutsche Telekom Root CA 2" root to be removed from Mozilla's Root Store.

Comment 5

[Arnold Essing]

Hello Kathleen, Yes, T-Systems is ready for the expired "Deutsche Telekom Root CA 2" root to be removed from Mozilla's Root Store.

Comment 6

[Rob Stradling]

(In reply to Kathleen Wilson from comment #2)

Rob, Please confirm that Sectigo is ready for the expired "UTN-USERFirst-Client Authentication and Email" root to be removed from Mozilla's Root Store.

Hi Kathleen. The primary use case for this root (S/MIME) expects long-term validation of signatures. Does NSS (or Thunderbird) support validation of S/MIME signatures after an end-entity S/MIME certificate has expired? Or after the end-entity and intermediate CA certificates have expired? Or (in this case) after the end-entity, intermediate and root CA certificates have expired?

(If yes to all of those questions, then it would be useful to keep this expired root in the NSS trust list)

Comment 7

[Kai Engert (:KaiE:)]

If any of the involved certificates expire, then NSS and Thunderbird treat the signature as no longer valid. The justification is that revocation checking is no longer possible, because CAs usually stop publishing revocation information after a certificate has expired. If my understanding about availability of revocation information is correct, then keeping the certificate wouldn't have any positive effect on signature status of old emails.

Comment 8

[Marcus Burghardt]

Attachment: Bug 1574670 - Remove Expired root certificates - Class 2 Primary, UTN-USERFirst-Client, Deutsche Telekom Root CA 2. r=jcj

Comment 9

[Kathleen Wilson]

Changing the neadinfo from Remi to Erwann, because I received an email reply saying Remi is OOO until September.

Comment 10

[Erwann Abalea]

Bonjour Kathleen,

I confirm that DocuSign France is ready to have the expired root CA "Class 2 Primary CA" removed from NSS.

Comment 12

[Rob Stradling]

(In reply to Kai Engert (:kaie:) from comment #7)

If any of the involved certificates expire, then NSS and Thunderbird treat the signature as no longer valid. The justification is that revocation checking is no longer possible, because CAs usually stop publishing revocation information after a certificate has expired. If my understanding about availability of revocation information is correct, then keeping the certificate wouldn't have any positive effect on signature status of old emails.

Thanks Kai. In that case...

(In reply to Kathleen Wilson from comment #2)

Rob, Please confirm that Sectigo is ready for the expired "UTN-USERFirst-Client Authentication and Email" root to be removed from Mozilla's Root Store.

Kathleen, I confirm that Sectigo is ready for the expired "UTN-USERFirst-Client Authentication and Email" root to be removed from Mozilla's Root Store.

Comment 13

[Kathleen Wilson]

Thanks, Arnold, Erwann, and Rob, for confirming that these expired root certs may be removed from Mozilla's root store.

Comment 14

[J.C. Jones [:jcj] (he/him)]

https://hg.mozilla.org/projects/nss/rev/eeb9a6715a93813f70596f32edc13a6b96c63a4b