Asseco Data Systems (Certum): Transition Plan for Existing Dual-Purpose Roots
Asseco Data Systems (Certum) submitted a refined transition plan for its multi-purpose (TLS and S/MIME) root generations. The plan describes moving from existing multi-purpose roots (G1 and G2) to a single-purpose G3 hierarchy, with migration phased to align with acceptance of the G3 roots into relevant root programs. Certum stated it will migrate TLS issuance to G3 and use cross-certified trust paths from G1/G2 to the new G3 roots while G3 roots await wider inclusion, and it will cease TLS issuance from multi-purpose roots once migration is complete. For S/MIME, Certum stated that issuance will be transitioned to G3 and that multi-purpose roots will cease S/MIME issuance after the proposed completion steps, while noting that ~20,000 valid certificates remain under G1/G2 for S/MIME. The plan includes proposed distrust dates for the Websites trust bit for certain TLS roots and proposed distrust dates for S/MIME after dates for specific generations. Certum also stated it does not plan to proactively revoke existing SubCAs issued from G1 or G2, and that these SubCAs will remain active until their natural expiration to avoid service disruptions.
- Certum/Asseco DS submitted a refined transition plan to move from multi-purpose G1/G2 roots to single-purpose G3 roots for TLS and S/MIME.
- Mozilla assigned the case to Ben Wilson.
- Assecods representative — Submitted the refined transition plan detailing affected roots, proposed migration approach for TLS and S/MIME, proposed distrust_after_date values, and stated it would not proactively revoke existing SubCAs from G1/G2.