IZENPE: Postpone removal of Izenpe Root CA TLS trust bit
Izenpe S.A. asked Mozilla to postpone removal of the TLS trust bit for its Root CA by one year, from 2026-04-15 to 2027-04-15, while it completed migration to a new PKI and new root. The request was driven by Izenpe’s transition away from an existing TLS hierarchy and its need to maintain service continuity for subscribers during the changeover. Mozilla asked for detailed timelines, audit information, subscriber migration plans, and monthly progress updates before evaluating the extension. Izenpe later reported delays in production rollout and CCADB submission, then said it had disclosed a public tender for a new TLS certificate provider and was moving to a new provider API. Chrome stated it would phase out the root using SCTNotAfter set to 2026-04-15, and Mozilla later said it intended to proceed with a distrustAfter date of 2026-04-15 and would close the bug on or before that date. The bug is now resolved.
- Scheduled distrust of Izenpe Root CA TLS certificate
- Izenpe S.A. — Izenpe requested a one-year extension for removal of the trust bit for its Root CA TLS certificate.
- Mozilla representative — Mozilla requested detailed deployment, audit, migration, contingency, and justification information before considering the extension.
- Izenpe S.A. — Izenpe provided milestone dates, subscriber counts, and a transition plan for moving to a new hierarchy.
- Mozilla representative — Mozilla asked Izenpe to post monthly updates starting 2025-07-15.
- Izenpe S.A. — Izenpe reported delays to production setup and CCADB submission and said ACME deployment would be tested once production was operational.
- Izenpe S.A. — Izenpe delayed production and CCADB submission further, cited ACME Renewal Information requirements, and disclosed a public tender for TLS certificate services.
- Google representative — Chrome said it would phase out the root using SCTNotAfter set to 2026-04-15 and encouraged Izenpe to prioritize subscriber transition.
- Mozilla representative — Mozilla asked Izenpe for an urgent migration update and noted Mozilla would likely apply a similar distrustAfter date of 2026-04-15.
- Izenpe S.A. — Izenpe said it was focused on integrating with the new provider API and gave updated dates for provider migration and subscriber communications.
- Izenpe S.A. — Izenpe said it had reduced TLS certificate validity to 195 days and was still working to include the new root.
- Mozilla representative — Mozilla said it intended to proceed with a distrustAfter date of 2026-04-15 and would close the bug on or before that date.