← GlobalSign nv-sa cases
Bugzilla #1347882
Trust Bit Disablement
Certificate Misissuance
GlobalSign: Remove EV bit from ex-GS roots now owned by GTS
RESOLVED
FIXED
GlobalSign nv-sa
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
GlobalSign disclosed that two of its root certificates, 'GlobalSign Root CA - R2' and 'GlobalSign Root CA - R4', were sold to Google Trust Services (GTS). The 'GlobalSign Root CA - R2' was enabled for Extended Validation (EV) but GTS does not have an EV audit, leading to a potential misissuance risk. The plan includes removing EV status from 'GlobalSign Root CA - R2', adding the GlobalSign intermediate to the trust store, and enabling it for EV. GlobalSign confirmed it would revoke certain certificates and update their status in the Common CA Database (CCADB). The bug has been resolved with the necessary actions completed.
Chronology
- GlobalSign disclosed the sale of two root certificates to GTS and initiated a plan to remove EV status from one.
- GlobalSign revoked the specified certificates and updated their status in the CCADB.
Thread Activity
- Mozilla representative — Gervase Markham outlined the plan to remove EV status from 'GlobalSign Root CA - R2' and add the GlobalSign intermediate.
- Mozilla representative — Kathleen Wilson confirmed the actions taken and the need for GlobalSign to revoke certain certificates.
- Mozilla representative — Kathleen reported that GlobalSign had revoked the specified certificates and updated their status.
- Mozilla representative — Gerv suggested that the bug could now be resolved as the necessary actions were completed.
Participants
Community commenter
External References
Similar Local Cases
GlobalSign: IP in dnsName
GlobalSign: AT&T SSL certificates without the AIA extension
GlobalSign: Invalid countryName
GlobalSign: Invalid stateOrProvinceName and locality pair
GlobalSign: S/MIME Sponsor validated certificates with CommonName value equal to OrganizationName
GlobalSign: AT&T Insufficient Serial Number Entropy
GlobalSign: 4 Misissued certificates with invalid CN
GlobalSign: Wrong business category (Non Commercial Entity when should have been Private Organization)