Google Trust Services reissued a root CA certificate with SHA-1 after a key-usage compliance change

Google Trust Services opened this case to disclose a root CA certificate reissuance tied to a key-usage compliance fix from Bug 1652581. GTS said it identified the SHA-1 issue during internal discussion about how to modify the root certificate, then consulted auditors and root-program contacts before reissuing the certificate on 2020-08-13 with its original SHA-1 signature algorithm. The thread focuses on whether that reissuance was compatible with Mozilla Root Store Policy, especially section 5.1.3, and on what communications and research informed GTS's decision. GTS later said it had disclosed the issue to its auditors, would take future interpretation questions to mozilla.dev.security.policy, and had implemented the remediation items unique to this response. Mozilla participants continued to question the adequacy of the explanation and the completeness of the remediation, but the bug was ultimately resolved and Mozilla stated it would not include the re-signed R2 CA certificate in GTS's pending inclusion request.

1. 2020-07-06 GTS identified a key-usage profile issue with a root certificate profile.
2. 2020-08-06 GTS received confirmation from auditors that they believed the change was allowed.
3. 2020-08-13 Google Trust Services reissued the root CA certificate using its original SHA-1 signature algorithm.
4. 2021-05-03 GTS opened the Mozilla bug to disclose the SHA-1 root certificate reissuance.
5. 2021-07-13 GTS said it had implemented all remediation items unique to this response.

1. 2021-05-03 Community commenter — GTS described how it discovered the SHA-1 issue during work on the root certificate modification and provided the initial incident timeline.
2. 2021-05-04 Mm representative — Mozilla asked GTS about its policy research, its awareness of MRSP section 5.1.3, and what it disclosed to Mozilla.
3. 2021-05-10 Community commenter — GTS explained why it believed the MRSP language was unclear and why it sought confirmation from Mozilla and auditors.
4. 2021-05-18 Community commenter — GTS said it had disclosed all known compliance issues to its auditors and expected the audit report to include relevant facts.
5. 2021-05-20 Google representative — GTS reiterated that it had disclosed the issues to auditors and said it would answer further questions.
6. 2021-05-26 Google representative — GTS said it would expand engineering participation in compliance review and take future interpretation conversations to mdsp.
7. 2021-06-01 Mozilla representative — Mozilla said the bug could be closed and planned to review it again on 2021-06-04.
8. 2021-07-13 Google representative — GTS said it had implemented all items in its remediation plan unique to this response.
9. 2021-07-26 Mozilla representative — Mozilla said it would close the bug on or about 2021-07-30 unless there were reasons to keep it open.