eMudhra: Transition plan for dual-purpose roots and related trust-bit changes
This bug tracks eMudhra’s transition away from dual-purpose roots under Mozilla Root Store Policy §7.5.3. Mozilla opened the case to coordinate the planned retirement of one trust purpose from four included roots: emSign ECC Root CA - C3, emSign ECC Root CA - G3, emSign Root CA - C1, and emSign Root CA - G1. eMudhra said it had moved new TLS issuance to dedicated TLS-only hierarchies and provided last non-TLS issuance dates and proposed distrust-after dates for the affected roots. In April 2026, eMudhra said the last S/MIME/non-TLS issuance date for emSign Root CA - G1 and emSign ECC Root CA - G3 was March 31, 2026, and proposed June 15, 2026 as the distrust-after date for emSign Root CA - C1 and emSign ECC Root CA - C3. In June 2026, eMudhra confirmed that revocation of all non-TLS subordinate CA certificates chaining to emSign Root CA - G1 and emSign ECC Root CA - G3 had been completed by June 15, 2026. On October 13, 2026, Mozilla noted that distrust-after and root removal are distinct actions, said neither change had been implemented yet, and asked eMudhra and Mozilla to clarify the intended changes and coordinate implementation. Mozilla also said the reported issuance of seven ICAs without EKU extensions was a separate compliance issue and asked eMudhra to file an incident report for that matter.
- Mozilla opened a tracking bug for eMudhra’s §7.5.3 transition plan for dual-purpose roots.
- eMudhra provided last non-TLS issuance dates and proposed distrust-after dates for the affected dual-purpose roots’ trust bits.
- eMudhra completed revocation of all non-TLS subordinate CA certificates chaining to emSign Root CA - G1 and emSign ECC Root CA - G3.
- Mozilla said the requested distrust-after and root removal changes had not yet been implemented and asked for clarification and coordination.
- Mozilla representative — Opened the bug to track eMudhra’s §7.5.3 transition obligations and requested estimated dates for when issuance would stop and when Mozilla should remove trust bits or configure distrust-after.
- Emudhra representative — Provided last S/MIME/non-TLS issuance dates and proposed distrust-after dates for the affected roots, and said the non-TLS issuing CAs would be revoked by June 15, 2026.
- Emudhra representative — Confirmed that revocation of all non-TLS subordinate CA certificates chaining to emSign Root CA - G1 and emSign ECC Root CA - G3 was completed as of June 15, 2026.
- Mozilla representative — Said the seven ICAs mentioned in the thread were signed by emSign Root CA - C1, noted that distrust-after and root removal are distinct actions, and stated that neither change had been implemented yet.