2089115 - Remove email trust and set TLS distrust-after to 2026-11-16 23:59:59 UTC for emSign Root CA - G1

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task, P1)

Description

[Ben Wilson]

This bug tracks TLS and S/MIME changes to trust settings for the emSign Root CA - G1.

Subject/Issuer: CN=emSign Root CA - G1, OU=emSign PKI, O=eMudhra Technologies Limited, C=IN
Serial number: 31F5E4620C6C58EDD6D8
SHA-256 fingerprint: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367
SHA-1 fingerprint: 8AC7AD8F73AC4EC1B5754DA540F4FCCF7CB58E8C

Requested changes

Remove the Email (S/MIME) trust bit:

In certdata.txt, remove email trust for the root by setting:

CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST

Set the TLS server distrust-after date to November 16, 2026, at 23:59:59 UTC

In certdata.txt, in the corresponding trust block, replace CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE with:

For Server Distrust After: Mon Nov 16 23:59:59 2026

CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
\062\066\061\061\061\066\062\063\065\071\065\071\132
END

Retain the Websites trust bit and EV enablement, subject to the TLS issuance cutoff. TLS certificates issued after the cutoff will be rejected, with SCT checking to prevent circumvention through backdating of the certificate’s notBefore value. Certificates issued on or before the cutoff may continue to validate accordingly, subject to normal certificate validation requirements.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 2089115 - remove email trust and set TLS distrustAfter for emSign Root CA - G1. r=bwilson

Comment 2

[Ben Wilson]

Approved D339715

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/a12c605b0fe5
remove email trust and set TLS distrustAfter for emSign Root CA - G1. r=bwilson