2085912 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Firmaprofesional root

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

Please set CKA_NSS_SERVER_DISTRUST_AFTER to 2026-08-06 07:01:00 UTC for the following root certificate:

• Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068, C=ES
• SHA-256 fingerprint: 57DE0583EFD2B26E0361DA99DA9DF4648DEF7EE8441C3B728AFA9BCDE0F9B26A
• Serial number: 1B70E9D2FFAE6C71
• Certificate: https://crt.sh/?q=57DE0583EFD2B26E0361DA99DA9DF4648DEF7EE8441C3B728AFA9BCDE0F9B26A
  (Not to be confused with the SHA-1 root certificate, fingerprint equal to 04048028BF1F2864D48F9AD4D83294366A828856553F3B14303F90147F5D40EF, which has already been removed from NSS.)

Background

Firmaprofesional has requested a voluntary phase-out of this root in Bug 2070507. It reports that publicly trusted TLS subscriber-certificate issuance from this hierarchy ceased on August 6, 2026, and that the final subscriber certificate has a notBefore value of 2026-08-06 07:00:59 UTC.

Requested behavior

For TLS end-entity certificates chaining to this root:

• Certificates with notBefore later than 2026-08-06 07:01:00 UTC must be distrusted.
• Certificates with notBefore equal to or earlier than that timestamp are eligible for trust if not expired or revoked.

Chrome’s separately configured SCT timestamp constraint for later (sctNotAfter = 2026-09-30 23:59:59 UTC) is not requested here.

Subsequent root removal

The root certificate and its websites trust bit will be retained for this transition until next year. Firmaprofesional reports that the latest expiration among the remaining TLS subscriber certificates is 2027-03-12 08:29:59 UTC. Final root removal will be tracked separately.

Comment 1

[Anna Weine]

Attachment: Bug 2085912 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Firmaprofesional root

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/22e5382db287
Set CKA_NSS_SERVER_DISTRUST_AFTER for Firmaprofesional root r=bwilson