1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority, Sonera Class2 CA

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Kathleen Wilson]

Please remove the following two expired root certificates from NSS:

CN=QuoVadis Root Certification Authority; OU=Root Certification Authority; O=QuoVadis Limited; C=BM
Valid To: 3/17/2021
Certificate Serial Number: 3AB6508B
SHA-1 Fingerprint: DE3F40BD5093D39B6C60F6DABC076201008976C9
SHA-256 Fingerprint: A45EDE3BBBF09C8AE15C72EFC07268D693A21C996FD51E67CA079460FD6D8873
Mozilla Trust Bits: Email;Websites
Not EV

CN=Sonera Class2 CA; O=Sonera; C=FI
Valid To: 4/6/2021
Certificate Serial Number: 1D
SHA-1 Fingerprint: 37F76DE6077C90C5B13E931AB74110B4F2E49A27
SHA-256 Fingerprint: 7908B40314C138100B518D0735807FFBFCF8518A0095337105BA386B153DD927
Mozilla Trust Bits: Email;Websites
Not EV

Comment 1

[Kathleen Wilson]

Stephen, for the QuoVadis Root Certification Authority, should we remove the root certificate from Mozilla's root store? Or should we only disable the Websites trust bit? (i.e. Do people still depend on that root certificate being included for S/MIME?)

Pekka, for the Sonera Class2 CA root, should we remove the root certificate from Mozilla's root store? Or should we only disable the Websites trust bit? (i.e. Do people still depend on that root certificate being included for S/MIME?)

Comment 2

[pekka.lahtiharju]

Expired Sonera Class2 CA may be removed. It isn't any more used anywhere.

Hopefully our new replacement root "Telia Root CA v2" will be added soon (application was done 8 months ago). Until it is included we continue using "TeliaSonera Root CA v1".

Comment 3

[Stephen Davidson]

Kathleen, thank you for confirming! QuoVadis Root Certification Authority may be removed.

Comment 4

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority. r=KathleenWilson

Depends on D115877

Comment 5

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1710716 - Remove Expired Sonera Class2 CA from NSS. r=KathleenWilson

Depends on D115882

Comment 6

[Benjamin Beurdouche [:beurdouche]]

https://hg.mozilla.org/projects/nss/rev/f7ff828026cd975bb846b1942313ae133d757f5f
https://hg.mozilla.org/projects/nss/rev/ef591b9d25a3e0811b598396396528e7b089b4f7