OISTE: Transition Plan for Existing Dual-Purpose Root (GB Root)
This case documents OISTE’s transition plan for its existing dual-purpose root, the “OISTE WISeKey Global Root GB CA” (GB Root), which currently issues both TLS and non-TLS (S/MIME) certificates. OISTE states that it created new single-purpose roots in 2023 and requested their inclusion in 2024, and that as of February 2026 only Mozilla and Gmail had included the new roots. For TLS, OISTE plans to stop TLS issuance by 15 June 2026 for CAs directly subordinated to the GB Root, and it requests that Mozilla remove the Websites trust bit in NSS for the GB Root by 1 May 2027, stating it needs the GB Root trusted for TLS until 17 April 2027 given certificate lifetimes. For S/MIME, OISTE expects to transfer issuance during Q2 2026 and stop new S/MIME issuances by 31 December 2026, requesting that the S/MIME trust bit be maintained for the GB Root until 31 April 2029. Mozilla asked OISTE to provide a defined trust transition milestone and a preferred trust-removal mechanism (e.g., TLS distrust-after date vs. removing the Websites trust bit) to support NSS planning. The bug remains in the ASSIGNED state.
- OISTE submitted a transition plan for the existing dual-purpose GB Root to move TLS and S/MIME issuance to newly created single-purpose roots.
- Mozilla requested specific trust-transition milestone details and preferred mechanisms for terminating TLS trust and clarifying long-term S/MIME intent.
- OISTE provided proposed dates and mechanisms for TLS trust removal in NSS and for maintaining S/MIME trust through a specified deadline.
- OISTE — OISTE described the current dual-purpose status of the GB Root and outlined cross-signing and issuance stop dates for TLS and S/MIME, including a request that the GB Root remain recognized for TLS/non-TLS purposes until specified deadlines.
- Mozilla representative — Mozilla asked OISTE to propose a tentative 2026–2027 trust transition milestone for removing TLS trust (either removing the Websites trust bit in NSS or applying a TLS distrust-after date) and to clarify long-term S/MIME issuance and trust-removal approach.
- OISTE — OISTE stated it would stop TLS issuance by 15 June 2026 and requested Websites trust bit removal in NSS by 1 May 2027, and it expected to stop S/MIME issuance by 31 December 2026 while requesting the S/MIME trust bit be maintained until 31 April 2029.