Open Bug 2017381 Opened 6 months ago Updated 4 months ago

TWCA: Transition Plan for Existing Dual-Purpose Roots

Categories

(CA Program :: CA Certificate Root Program, task)

Product:
CA Program
Component:
CA Certificate Root Program
Type:
task

Tracking

(Not tracked)

Status:
ASSIGNED

People

(Reporter: bwilson, Assigned: bwilson)

Details

(Whiteboard: [transition-plan])

TWCA currently operates four root certificates included in Mozilla:

TWCA Root Certification Authority
Trust Bits: Websites, Email
Status: No longer used for new issuance

TWCA Global Root CA
Trust Bits: Websites, Email
Status: Currently issuing both TLS and S/MIME certificates

TWCA CYBER Root CA
Trust Bits: Websites
Status: Dedicated TLS hierarchy

TWCA Global Root CA G2
Trust Bits: Email
Status: Dedicated S/MIME hierarchy

Transition Plan

1. TLS Migration

Effective May 4, 2026, all new TLS certificates will be issued under the TWCA CYBER Root CA (TLS-only hierarchy), and issuance under the dual-purpose TWCA Global Root CA for TLS will cease.

Dependencies/Considerations

  • TWCA is depending on the Apple Root Program's inclusion of TWCA CYBER Root CA.
  • TWCA acknowledges potential IIS validation issues in certain cross-signing scenarios.
  • TWCA will proactively provide customer guidance consistent with Microsoft’s official recommendations to ensure proper certificate validation.

2. S/MIME Migration

Target Completion Date: June 2028 (no later than)
All S/MIME issuance will migrate from TWCA Global Root CA to TWCA Global Root CA G2 (S/MIME-only hierarchy).

Dependencies/Considerations

  • Migration timing depends on inclusion of TWCA Global Root CA G2 in the Apple Root Program.
  • Migration will begin immediately upon Apple approval.

3. Post-Transition State

  • TLS issuance will occur exclusively under TWCA CYBER Root CA.
  • S/MIME issuance will occur exclusively under TWCA Global Root CA G2.
  • The dual-purpose TWCA Global Root CA will no longer issue new certificates.
  • The legacy TWCA Root Certification Authority remains unused for new issuance.

Purpose of This Tracking Bug

This bug is filed for:

  • Ongoing monitoring of TWCA’s transition milestones
  • Documentation of commitments made to the Mozilla Root Program
  • Future verification that issuance under multi-purpose hierarchies has ceased
  • Updates will be requested from TWCA as needed

Information Sync

  • TLS Migration Completed: As of May 4, 2026, TWCA has transitioned its TLS users to the single-purpose TWCA CYBER Root CA chain.
  • Root Deprecation: TWCA acknowledges the upcoming removal of the TWCA Root Certification Authority (Fingerprint ending in AC44) in April 2027 per Mozilla’s schedule. TWCA is in agreement with this plan and has no further comments.
You need to log in before you can comment on or make changes to this bug.