1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, enhancement)

Description

[Kathleen Wilson]

Please set CKA_NSS_EMAIL_DISTRUST_AFTER to the specified dates for the following root certificates. This distrusts S/MIME certs that have “Valid From” newer than the specified date. S/MIME certificates issued prior to this date will continue to be trusted until the certificate’s natural expiration or until we disable the trust bit or remove the root.

• Email Distrust After Date: 8/31/2022
  Subject: CN=VeriSign Class 1 Public Primary Certification Authority - G3; OU=VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only; O=VeriSign, Inc.; C=US
  Certificate Serial Number: 008B5B75568454850B00CFAF3848CEB1A4
  SHA-1 Fingerprint: 204285DCF7EB764195578E136BD4B7D1E98E46A5
  SHA-256 Fingerprint: CBB5AF185E942A2402F9EACBC0ED5BB876EEA3C1223623D00447E4F3BA554B65

• Email Distrust After Date: 8/31/2022
  Subject: CN=Symantec Class 1 Public Primary Certification Authority - G6; OU=Symantec Trust Network; O=Symantec Corporation; C=US
  Certificate Serial Number: 243275F21D2FD20933F7B46ACAD0F398
  SHA-1 Fingerprint: 517F611E29916B5382FB72E744D98DC3CC536D64
  SHA-256 Fingerprint: 9D190B2E314566685BE8A889E27AA8C7D7AE1D8AADDBA3C1ECF9D24863CD34B9

• Email Distrust After Date: 8/31/2022
  Subject: CN=Symantec Class 2 Public Primary Certification Authority - G6; OU=Symantec Trust Network; O=Symantec Corporation; C=US
  Certificate Serial Number: 64829EFC371E745DFC97FF97C8B1FF41
  SHA-1 Fingerprint: 40B331A0E9BFE855BC3993CA704F4EC251D41D8F
  SHA-256 Fingerprint: CB627D18B58AD56DDE331A30456BC65C601A4E9B18DEDCEA08E7DAAA07815FF0

• Email Distrust After Date: 8/31/2022
  Subject: CN=VeriSign Class 2 Public Primary Certification Authority - G3; OU=VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only; O=VeriSign, Inc.; C=US
  Certificate Serial Number: 6170CB498C5F984529E7B0A6D9505B7A
  SHA-1 Fingerprint: 61EF43D77FCAD46151BC98E0C35912AF9FEB6311
  SHA-256 Fingerprint: 92A9D9833FE1944DB366E8BFAE7A95B6480C2D6C6C2A1BE65D4236B608FCA1BB

• Email Distrust After Date: 8/31/2022
  Subject: CN=VeriSign Universal Root Certification Authority; OU=VeriSign Trust Network, (c) 2008 VeriSign, Inc. - For authorized use only; O=VeriSign, Inc.; C=US
  Certificate Serial Number: 401AC46421B31321030EBBE4121AC51D
  SHA-1 Fingerprint: 3679CA35668772304D30A5FB873B0FA77BB70D54
  SHA-256 Fingerprint: 2399561127A57125DE8CEFEA610DDF2FA078B5C8067F4E828290BFB860E84B3C

Comment 1

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER. r=kjacobs,jcj

Comment 2

[Benjamin Beurdouche [:beurdouche]]

https://hg.mozilla.org/projects/nss/rev/642b574bfa5e9528356d864e8786a03c3b405375