2085917 - Remove Buypass Class 2 Root CA and Buypass Class 3 Root CA from NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

After November 1, 2026, please remove the following root certificates and their associated trust records from the NSS built-in root store:

1. Buypass Class 2 Root CA
   SHA-256: 9A114025197C5BB95D94E63D55CD43790847B646B23CDF11ADA4A00EFF15FB48

2. Buypass Class 3 Root CA
   SHA-256: EDF7EBBCA27A2A384D387B7D4010C666E2EDB4843E4C29B4AE1D5B9332E6B24D

Background

Buypass has notified Mozilla that it is terminating its publicly trusted TLS certificate operations and has confirmed that it intends to proceed with removal of its roots.

According to Buypass:

• TLS certificate issuance ceased by October 31, 2025.
• The last TLS subscriber certificates will expire by October 31, 2026.
• Buypass intends to revoke the remaining issuing CA certificates and wind down the associated TLS operations.

Implementation dependency

Before removing Buypass Class 3 Root CA from NSS, remove its EV treatment from Firefox’s security/certverifier/ExtendedValidation.cpp. Please coordinate the changes so that the EV removal lands before the NSS root removal is incorporated into Firefox.

Requested timing

Please schedule removal as soon as practicable after November 1, 2026, preferably in a release available before December 2026.

Please identify the target NSS release and expected release date so that we can coordinate with Buypass and confirm the endpoint for its final audit coverage. Its current annual audit period ends October 31, 2026, and it plans to obtain contiguous audit coverage from November 1 through the confirmed Mozilla audit endpoint.

Scope

This request is for complete removal of both root certificates and their associated trust records from NSS.

Comment 1

[Anna Weine]

Attachment: Bug 2085917 - Remove Buypass Class 2 Root CA and Buypass Class 3 Root CA from NSS. r=bwilson

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/7bbb0c2b9695
Remove Buypass Class 2 Root CA and Buypass Class 3 Root CA from NSS. r=bwilson

Comment 3

[Ben Wilson]

Removed in NSS 3.134 and FF 162