Add FNMT TLS RSA Root Certificate SERVIDORES SEGUROS G2R

FNMT requested inclusion of a new TLS-dedicated root CA in Mozilla’s root program. The CA said the new root, “AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R,” was created to replace the existing multi-purpose root “AC RAIZ FNMT-RCM.” FNMT stated the new root is exclusively intended for issuance of TLS server certificates, with end-entity certificates restricted to the id-kp-serverAuth EKU. The request included the root’s name, subject details, and a SHA-256 fingerprint, and it referenced a crt.sh link for the fingerprint. FNMT also provided a CCADB root inclusion case link (CaseNumber=00003087). The bug is currently in ASSIGNED status, with no resolution stated in the thread.

1. 2026-04-14 FNMT submitted a request to include a new TLS-dedicated root CA intended to replace an existing multi-purpose FNMT root.

1. 2026-04-14 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — Requested inclusion of the new root “AC RAIZ FNMT-RCM SERVIDORES SEGUROS G2R,” describing its TLS-only purpose, serverAuth EKU restriction, and providing fingerprint and CCADB case links.