760167 - Turn off code signing trust bit for TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3 cert in NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Kathleen Wilson]

Please turn off the Code Signing trust bit for the following cert in NSS:

O = Türkiye Bilimsel ve Teknolojik Araştırma Kurumu - TÜBİTAK
CN = TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3
SHA1: 1B:4B:39:61:26:27:6B:64:91:A2:68:6D:D7:02:43:21:2D:1F:1D:96 

As per bug #499705 only the Websites and Email trust bits are supposed to be enabled for this root cert.

I have exchanged email with the CA and they have responded:
"Since we don't issue Code Signing certificates, there will not be any negative impact when you disable it."

Comment 1

[Kai Engert (:KaiE:)]

Do we need verification by the CA that trust flags are still appropriate?

If we do:

The test build is available at
  http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-b51f34a5b5c1/
or from
  http://kuix.de/mozilla/tryserver-roots-20120604/

(see initial comments in this bug,
 and you should make sure that you're using a fresh profile
 to make sure you really see the trust bits provided by this build,
 not trust settings that you had set manually in an application profile.)

Comment 2

[Kathleen Wilson]

(In reply to Kai Engert (:kaie) from comment #1)
> Do we need verification by the CA that trust flags are still appropriate?

I don't think so, since this is more like fixing a bug.

I installed the test build shown above, and reset my cert store as described here:
https://wiki.mozilla.org/CA:UserCertDB#How_To_Restore_Default_Root_Certificate_Settings

In the Authorities list in the Certificate Manager I see the following trust bit setting:

CN = TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3
Trust bits turned on: SSL, Email

Therefore, I confirm that the trust bits are set as requested in bug #499705. 

Thanks,
Kathleen