TWCA: Transition Plan for Existing Dual-Purpose Roots
This case tracks TWCA’s plan to transition from existing dual-purpose roots included in Mozilla to single-purpose hierarchies. TWCA’s roots in Mozilla include TWCA Root Certification Authority (no longer used for new issuance), TWCA Global Root CA (currently issuing both TLS and S/MIME), TWCA CYBER Root CA (TLS-only), and TWCA Global Root CA G2 (S/MIME-only). The initial plan states that TLS issuance would migrate effective May 4, 2026, ceasing issuance under the dual-purpose TWCA Global Root CA for TLS and moving TLS issuance to TWCA CYBER Root CA, with dependencies on Apple Root Program inclusion and notes about potential IIS validation issues in certain cross-signing scenarios. For S/MIME, the plan targets completion by June 2028 (no later than), migrating S/MIME issuance from TWCA Global Root CA to TWCA Global Root CA G2, beginning immediately upon Apple approval. In the thread update, TWCA confirmed that the TLS migration was completed as of May 4, 2026, and acknowledged the upcoming removal of the TWCA Root Certification Authority in April 2027 per Mozilla’s schedule. The bug is used for ongoing monitoring of transition milestones and documentation of commitments to the Mozilla Root Program.
- TWCA submitted a transition plan to migrate TLS and S/MIME issuance from dual-purpose roots to single-purpose hierarchies.
- TWCA completed the TLS migration to the TWCA CYBER Root CA chain.
- TWCA provided an update confirming TLS migration completion and agreeing with the planned root deprecation/removal timeline.
- Mozilla representative — Ben Wilson posted TWCA’s transition plan, including TLS migration effective May 4, 2026 and an S/MIME migration target of June 2028 (no later than), plus related dependencies and post-transition issuance expectations.
- Taiwan-CA Inc. (TWCA) — TWCA confirmed that TLS migration was completed as of May 4, 2026 and agreed with the upcoming removal of the TWCA Root Certification Authority in April 2027 per Mozilla’s schedule.