Camerfirma: Invalid country field in Camerfirma root CA certificates
This case reports that four Camerfirma root CA certificates included in Mozilla NSS had an invalid subject country field value. The reporter observed that the certificates used C=EU and stated that “EU is not a country,” and expected the country field to be C=ES. A comment in the thread notes that only country codes listed in ISO 3166 are valid for the “C” field, and another comment cites a Mozilla Baseline Requirements section about the subject:countryName needing the two-letter ISO 3166-1 country code associated with the subject’s location. The bug was later marked RESOLVED with resolution INVALID. In a 2025 comment, the reporter stated that the certificate had been removed from NSS a few years earlier and referenced other Bugzilla IDs as examples. The thread does not describe any CA remediation action in response to the reported field issue.
- A bug was filed reporting that Camerfirma root CA certificates in Mozilla NSS used C=EU in the subject country field.
- Discussion clarified that ISO 3166 country codes are required for the subject “C” field and debated whether EU could be treated as a valid code.
- The reporter noted the certificates had been removed from NSS and pointed to related Bugzilla entries.
- Trentalancia representative — Reported that four Camerfirma root CA certificates installed in NSS had an invalid country field (C=EU) and expected C=ES instead.
- Trentalancia representative — Cited ISO guidance stating that only ISO 3166-listed country codes are valid for the “C” field.
- Fastly representative — Noted the roots had been included in the Mozilla program for more than 7 years, predating documented requirements for these fields.
- Sectigo — Argued the report might be wrong, citing ISO 3166 exceptional reservations and discussing how Baseline Requirements define the subject countryName.
- Trentalancia representative — Reiterated that the organization is a private Spanish company and requested verification that the country code should be C=ES.
- Trentalancia representative — Stated the certificate had been removed from NSS a few years earlier and linked to other Bugzilla IDs.