FNMT-RCM: Transition Plan for Existing Roots
This case from Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) describes a transition plan to migrate from the multipurpose root CA “AC Raiz FNMT-RCM” to a new dedicated single-purpose hierarchy “AC Raiz FNMT-RCM Servidores Seguros G2R”. The plan is stated to be in compliance with Mozilla’s Root Store Policy sections 7.5 and 7.4, and it references Mozilla’s published Root CA Lifecycle transition schedule. The thread explains that “AC Raiz FNMT-RCM” is scheduled to have its websites trust bit removed on April 15, 2027, and FNMT requests maintaining the TLS trust bit for the existing self-signed root CA until December 31, 2028 to preserve trust for TLS certificates issued under the current root during the transition. The case includes details about the current multipurpose root (including that it is used to issue both TLS and non-TLS) and the new dedicated TLS hierarchy (including key details and subordinate CA usage). It also provides a timeline and milestones, including a key ceremony on December 16, 2025, disclosure of the dedicated TLS root in CCADB on December 19, 2025, completion of initial audits by April 1, 2026, and planned migration/cessation of issuance dates in 2026. The bug is currently in the ASSIGNED state.
- FNMT held the key ceremony for the new root and subordinate CA and generated a cross-signed certificate to support transition.
- FNMT disclosed the dedicated TLS root certificate in CCADB (case 00002870).
- FNMT completed initial audits and made the audit attestation reports available.
- FNMT planned to cease issuance from the multipurpose hierarchy and stop TLS issuance from the legacy root.
- Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Amaya Espinosa submitted a transition plan requesting that the TLS trust bit for the existing self-signed root CA be maintained until December 31, 2028, and described the migration to the dedicated TLS hierarchy plus timeline and root details.