2085902 - [meta] November 2026 Batch of CA Program-requested Root Changes for NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

List Updated: 11/05/2026

EV TREATMENT (PSM)
Remove Amazon - Bug #2088195
Amazon Root CA 1
Amazon Root CA 2
Amazon Root CA 3
Amazon Root CA 4
Starfield Services Root Certificate Authority – G2

Add HARICA - Bug #203918
CN=Hellenic Academic and Research Institutions ECC RootCA 2015
CN=Hellenic Academic and Research Institutions RootCA 2015

ROOT REMOVALS

Buypass - Bug #2085917
CN=Buypass Class 2 Root CA; O=Buypass AS-983163327; C=NO
SHA-256 Fingerprint: 9A114025197C5BB95D94E63D55CD43790847B646B23CDF11ADA4A00EFF15FB48

CN=Buypass Class 3 Root CA; O=Buypass AS-983163327; C=NO
SHA-256 Fingerprint: EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D

DISTRUST-AFTERS

Firmaprofesional - Bug #2085912
CN=Autoridad de Certificacion Firmaprofesional CIF A62634068, C=ES
SHA-256 fingerprint: 57DE0583EFD2B26E0361DA99DA9DF4648DEF7EE8441C3B728AFA9BCDE0F9B26A

eMudhra TLS distrust-after to 2026-11-16 23:59:59 UTC for emSign Root CA - G1 - Bug #2089115
CN=emSign Root CA - G1, OU=emSign PKI, O=eMudhra Technologies Limited, C=IN
SHA-256 fingerprint: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367

TRUST-BIT REMOVALS

eMudhra - Bug #2089115
Remove Email Trust bit
CN=emSign Root CA - G1, OU=emSign PKI, O=eMudhra Technologies Limited, C=IN
SHA-256 fingerprint: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367

Certigna - Bug #2085928
Remove Websites Trust bit (no EV)
CN=Certigna Root CA; OU=0002 48146308100036; O=Dhimyotis; C=FR
SHA-256: D48D3D23EEDB50A459E55197601C27774B9D7B18C94D5A059511A10250B93168

DigiCert - Bug #2088266
Remove Email Trust bit
DigiCert Global Root G2
SHA-256: CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F
DigiCert Global Root G3
SHA-256: 31AD6648F8104138C738F39EA4320133393E3A18CC02296EF97C2AC9EF6731D0

Remove Websites Trust bit (EV)
DigiCert Trusted Root G4
SHA-256: 552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988

Remove Websites Trust bit (no EV)
QuoVadis Root CA 1 G3
SHA-256: 8A866FD1B276B57E578E921C65828A2BED58E9F2F288054134B7F1F4BFC9CC74
QuoVadis Root CA 3 G3
SHA-256: 88EF81DE202EB018452E43F864725CEA5FBD1FC2D9D205730709C5D8B8690F46

SHECA - Bug #2088275
Remove Email Trust bit
CN=UCA Global G2 Root, O=UniTrust, C=CN
SHA-256: 9BEA11C976FE014764C1BE56A6F914B5A560317ABD9988393382E5161AA0493C

Identrust - Bug #2088279
Remove Email Trust bit
IdenTrust Commercial Root CA 1
SHA-256: 5D56499BE4D2E08BCFCAD08A3E38723D50503BDE706948E42F55603019E528AE

Comment 1

[Anna Weine]

Attachment: Bug 2085902 - Set nssckbi version to 2.94. r=bwilson

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/4bdd9d0967a9
Set nssckbi version to 2.94. r=jschanck