2088275 - Remove Email trust bit from UCA Global G2 Root

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

Please remove the Email (S/MIME) trust bit from the following root certificate in NSS:

• Certificate name: UCA Global G2 Root
• Subject: CN=UCA Global G2 Root, O=UniTrust, C=CN
• SHA-256 fingerprint: 9BEA11C976FE014764C1BE56A6F914B5A560317ABD9988393382E5161AA0493C
• Current trust: Websites, Email
• Requested trust: Websites only

This change implements SHECA’s transition to single-purpose TLS usage, tracked in Bug 2019027. SHECA has confirmed that the hierarchy under this root has been converted to TLS-only and formally requested removal of the S/MIME trust bit after March 15, 2026, in Comment 2.

Please update the root’s trust record in certdata.txt to disable Email trust while retaining Websites trust.

Comment 1

[Anna Weine]

Attachment: Bug 2088275 - Remove Email Trust Bit from UCA Global G2 Root. r=bwilson

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/6e46a3270643
Remove Email Trust Bit from UCA Global G2 Root. r=bwilson