2077222 - CCADB entries generated 2026-10-01T17:00:53Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, enhancement)

Description

[Common CA Database to OneCRL Bot]

Adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.

Comment 1

[Common CA Database to OneCRL Bot]

Attachment: Line delimited issuer/serial pairs

Comment 2

[Common CA Database to OneCRL Bot]

Attachment: The additions to OneCRL proposed by this bug.

Comment 3

[Common CA Database to OneCRL Bot]

Attachment: Entries with their names decoded to plain text and hexadecimal serials/hashes.

Comment 4

[Ben Wilson]

I've compared the list in the file "Line delimited issuer/serial pairs" and it contains the following 13 CA certificates to be added to OneCRL, which is consistent with the records of the request in the CCADB:

1. issuer: /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS RSA Root CA 2024 serial: 47a5912ae5c8a8436bc6401090d4c1c9
2. issuer: /C=BE/O=GlobalSign nv-sa/CN=GlobalSign Root R46 serial: 0084435852a4652ed24ce5945b5cf618b1
3. issuer: /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS RSA Root CA 2024 serial: 47a5912b55deec0ed1c1414ef7a1f87d
4. issuer: /C=ES/O=FNMT-RCM/OU=AC RAIZ FNMT-RCM serial: 3e7cfd54cde5e16d51cc498e1b1ecd48
5. issuer: /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS ECC Root CA 2024 serial: 4fe6b3fc368d1f357f73349b57c6fe49
6. issuer: /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root E46 serial: 00810aab86065e3384bf2825539eff3f88
7. issuer: /C=CN/O=China Financial Certification Authority/CN=CFCA EV ROOT serial: 7d74a24246794d9dc4c7
8. issuer: /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 serial: 22b9b12f4d05f9ed13
9. issuer: /C=DE/O=D-Trust GmbH/CN=D-TRUST EV Root CA 2 2023 serial: 52ed26b030918df0b4874de446d8f622
10. issuer: /C=JP/O=SECOM Trust Systems Co., Ltd./CN=SECOM TLS ECC Root CA 2024 serial: 4fe6b3fd845c6caee2831f2277e80a9f
11. issuer: /C=CN/O=China Financial Certification Authority/CN=CFCA EV ROOT serial: 57525f8a28c689e82458f1fe171e63ed
12. issuer: /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46 serial: 552d03ba8df38c1502029bc26d0ce4f9
13. issuer: /C=CN/O=China Financial Certification Authority/CN=CFCA Global RSA ROOT G2 serial: 78f92821cef7515a45ea

Comment 5

[Ben Wilson]

These 13 records correspond to the 13 new records in remote settings staging preview of OneCRL. A security engineer will need to:

• Approve them in Kinto Staging;
• Confirm that the OneCRL data in Staging Nightly is as intended, using remote-settings-devtools in a development profile; and
• Paste or attach the output from the onecrl-entry-checker tool here.

Comment 6

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=2077222

Comment 7

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=2077222

Comment 8

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=2077222

Comment 9

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=2077222

Comment 10

[Dana Keeler (she/her) [:keeler]]

Attachment: onecrl-entry-checker output

Comment 11

[Dana Keeler (she/her) [:keeler]]

Approved in stage.

Comment 12

[Ben Wilson]

Thanks. I've compared the OneCRL additions file with the OneCRL Entry Checker output and they have the same 13 certificates. Please push these from staging into production.

Comment 13

[Dana Keeler (she/her) [:keeler]]

Approved in prod.

Comment 14

[Ben Wilson]

These 13 entries are now in OneCRL.