← Google Trust Services LLC cases
Bugzilla #1709223
Policy Compliance
Google Trust Services: Signing SHA-1 Hash for existing CA certificate with changes in Key Usage
RESOLVED
FIXED
Google Trust Services LLC
AI Summary
Google Trust Services (GTS) reissued a Root CA certificate using SHA-1 for its signature, which raised compliance concerns regarding the Mozilla Root Store Policy (MRSP). The CA believed that their actions were compliant based on discussions with auditors and interpretations of the policy. However, this incident highlighted a misunderstanding of the MRSP, particularly regarding the prohibition of SHA-1 usage for root certificates. GTS has committed to improving its compliance processes and engaging with the community for future policy interpretations.
Chronology
- CA/B Forum Baseline requirements ban the use of SHA-1 for end-entity and SubCA certificates.
- GTS reissues the Root CA certificate using its original SHA-1 signature algorithm.
Participants
Ryan Hurst
Matthias
Fotis
Ben Wilson
External References
Similar Local Cases
PKIoverheid / QuoVadis: CPS inconsistencies
Google Trust Services: invalid curve-hash combination
Google Trust Services: Incomplete CRL Distribution Point URLs in CCADB for GTS Roots
NetLock: Replacement of enduser certificates after the EVGL 1.7.4 self-audit
NAVER Cloud Trust Services: Failure to Respond to May 2022 Survey
Ernst & Young Poland: KIR OCSP "unknown" status for revoked certificate
Google Trust Services: Out-of-date CPS disclosure
Amazon Trust Services: CP/CPS does not specify key compromise methods