2017453 - Remove Websites Trust Bit from DigiCert 2006 Roots

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

On or about 4/15/2026, remove the Websites Trust Bit from the following five (5) Roots:

CN=DigiCert Assured ID Root CA; OU=www.digicert.com; O=DigiCert Inc; C=US
Serial No.: 0CE7E0E517D846FE8FE560FC1BF03039
SHA1 hash: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
SHA256 hash: 3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C
Valid from: 2006 Nov 10
Valid to: 2031 Nov 10

CN=DigiCert Global Root CA; OU=www.digicert.com; O=DigiCert Inc; C=US
Serial No.: 083BE056904246B1A1756AC95991C74A
SHA1 hash: A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
SHA256 hash: 4348A0E9444C78CB265E058D5E8944B4D84F9662BD26DB257F8934A443C70161
Valid from: 2006 Nov 10
Valid to: 2031 Nov 10

CN=DigiCert High Assurance EV Root CA; OU=www.digicert.com; O=DigiCert Inc; C=US
Serial No.: 02AC5C266A0B409B8F0B79F2AE462577
SHA1 hash: 5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
SHA256 hash: 7431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF
Valid from: 2006 Nov 10
Valid to: 2031 Nov 10

CN=QuoVadis Root CA 2; O=QuoVadis Limited; C=BM
Serial No.: 0509
SHA1 hash: CA3AFBCF1240364B44B216208880483919937CF7
SHA256 hash: 85A0DD7DD720ADB7FF05F83D542B209DC7FF4528F7D677B18389FEA5E5C49E86
Valid from: 2006 Nov 24
Valid to: 2031 Nov 24

CN=QuoVadis Root CA 3; O=QuoVadis Limited; C=BM
Serial No.: 05C6
SHA1 hash: 1F4914F7D874951DDDAE02C0BEFD3A2D82755185
SHA256 hash: 18F1FC7F205DF8ADDDEB7FE007DD57E3AF375A9C4D8D73546BF4F1FED1E18D35
Valid from: 2006 Nov 24
Valid to: 2031 Nov 24

Comment 1

[Ben Wilson]

Current average daily validations (validations_on_day) for certificates under these Root CAs is approximately:

DigiCert Assured ID Root CA             3,267 
DigiCert Global Root CA              31.8 million
DigiCert High Assurance EV Root CA   1.3 million
QuoVadis Root CA 2                        58
QuoVadis Root CA 3                        0

Comment 2

[Anna Weine]

Attachment: Bug 2017453 - Remove Websites Trust Bit from DigiCert 2006 Roots

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/54ab7f3a2c2c
Remove Websites Trust Bit from DigiCert 2006 Roots r=bwilson