Google Trust Services reissued root certificates to add digitalSignature KeyUsage

Google Trust Services opened this bug after reviewing its root and sub-CA profiles and receiving an external note that its root CAs did not have the digitalSignature KeyUsage bit set. GTS concluded that the bit was required because the roots were used to sign OCSP responses, and it treated the missing bit as a compliance issue under section 7.1.2.1 of the Baseline Requirements. The CA said it would reissue the affected root certificates and continued serving OCSP responses from the existing roots while preparing the fix. GTS reported that the reissuance ceremony took place on 2020-08-13 without issues, and later said the revised root certificates were published on pki.goog. The thread then shifted to related questions about linting, review procedures, and a separate SHA-1 concern, but the original digitalSignature issue was described as already resolved. Mozilla later noted the issue had been resolved with the re-signing and discussed closing the bug.

1. 2016-06-22 Google Trust Services issued its root CAs and began serving OCSP responses signed using the root CA private keys.
2. 2020-07-06 An external note alerted GTS that its root CAs did not have the digitalSignature KeyUsage bit set.
3. 2020-07-07 GTS concluded the digitalSignature bit was required and agreed to reissue the affected root CA certificates.
4. 2020-08-13 GTS held the reissuance ceremony and corrected the affected root certificates.
5. 2020-08-28 GTS published the revised root certificates on pki.goog.

1. 2020-07-13 Google representative — Andy Warner filed the bug and explained that GTS had found the missing digitalSignature bit during review of related CA profile issues and an external inquiry.
2. 2020-07-13 Community commenter — Ryan Sleevi asked what analysis supported GTS's statement that there was no immediate security or compatibility impact.
3. 2020-07-13 Google representative — Andy Warner said GTS had tested clients and had seen no reports of problems over four years, which supported its statement.
4. 2020-08-17 Google representative — GTS reported that the ceremony to fix the issue had taken place on 2020-08-13 and that CCADB and other updates were mostly complete.
5. 2020-09-22 Google representative — Andy Warner explained that GTS used zlint and manual reviews, and that the review process had since been updated to require verbose lint output and explicit review of notices.
6. 2020-09-24 Google representative — Andy Warner corrected an earlier statement about zlint history and said the review process had been changed to catch issues like this more reliably.
7. 2020-10-05 Mozilla representative — Ben Wilson linked the related CCADB root inclusion case information.
8. 2021-05-10 Mozilla representative — Ben Wilson stated that the digitalSignature KeyUsage issue had already been resolved by the re-signing.