1915902 - SwissSign: Remove SwissSign Silver CA – G2

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

SwissSign has requested the removal of the SwissSign Silver CA - G2 Root CA from the root store on or about 12/31/2024.
The last S/MIME certificate issued under this CA will expire on 17 October 2024. (I'm assuming that there are no TLS server certificates issued under this root.)

CN=SwissSign Silver CA - G2; O=SwissSign AG; C=CH
Valid From (GMT): 10/25/2006
Valid To (GMT): 10/25/2036
Certificate Serial Number: 4F1BD42F54BB2F4B
SHA-1 Fingerprint: 9BAAE59F56EE21CB435ABE2593DFA7F040D11DCB
SHA-256 Fingerprint: BE6C4DA2BBB9BA59B6F3939768374246C3C005993FA98F020D1DEDBED48A81D5

Comment 1

[Ben Wilson]

Presumably the following will need to be deleted from certdata.txt:
#
# Certificate "SwissSign Silver CA - G2"
#
# Issuer: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH
# Serial Number:4f:1b:d4:2f:54:bb:2f:4b
# Subject: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH
# Not Valid Before: Wed Oct 25 08:32:46 2006
# Not Valid After : Sat Oct 25 08:32:46 2036
# Fingerprint (SHA-256): BE:6C:4D:A2:BB:B9:BA:59:B6:F3:93:97:68:37:42:46:C3:C0:05:99:3F:A9:8F:02:0D:1D:ED:BE:D4:8A:81:D5
# Fingerprint (SHA1): 9B:AA:E5:9F:56:EE:21:CB:43:5A:BE:25:93:DF:A7:F0:40:D1:1D:CB
CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
CKA_TOKEN CK_BBOOL CK_TRUE
CKA_PRIVATE CK_BBOOL CK_FALSE
CKA_MODIFIABLE CK_BBOOL CK_FALSE
CKA_LABEL UTF8 "SwissSign Silver CA - G2"
...
CKA_SERIAL_NUMBER MULTILINE_OCTAL
\002\010\117\033\324\057\124\273\057\113
END
CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

Comment 2

[Dennis Jackson]

Attachment: Bug 1915902 - Remove SwissSign Silver CA – G2. r=#nss-reviewers

Comment 3

[Dennis Jackson]

https://hg.mozilla.org/projects/nss/rev/293aba59f05c224baf1c5cdd69cf61f73b0e79fb