Identrust: Transition Plan for Existing Dual-Purpose Roots
This case is a Mozilla Root Store Program transition plan submitted by IdenTrust. The plan is submitted to meet Mozilla Root Store Program requirement 7.5.3, which requires dual-purpose roots (Websites + Email trust bits) to file a migration plan by April 15, 2026 and complete transitions to dedicated hierarchies by December 31, 2028. IdenTrust states it is migrating from long-standing multi-purpose roots to single-purpose hierarchies, with transitional cross-signing pending acceptance of new single-purpose hierarchies by root programs. The plan describes a Phase 1 migration where Non-TLS ICAs subordinate to IdenTrust Commercial Root CA 1 are to be revoked prior to June 15, 2026, while continuing S/MIME issuance under cross-signed chains under IdenTrust Public Sector Root CA 1. It also describes Phase 2 where IdenTrust Commercial Root CA 1 becomes a TLS-only root and the email trust bit removal is to be requested after June 15, 2026, with TLS issuance continuing under existing TLS ICAs. The plan further outlines Phase 3 migration to dedicated TLS and S/MIME roots, including cross-signing of dedicated S/MIME-only roots by Public Sector Root CA 1 and subsequent migration of S/MIME issuance to those dedicated roots. The bug is currently in ASSIGNED status.
- IdenTrust submitted a transition plan to migrate dual-purpose roots to dedicated TLS and S/MIME hierarchies under Mozilla Root Store Program requirement 7.5.3.
- IdenTrust Services, LLC — IdenTrust provided a detailed transition plan describing phases, target roots, cross-signing approach, and revocation/bit-removal and migration timelines.