FNMT: non-TLS intermediate CAs lacked EKU; OneCRL mitigation is complete and migration remains ongoing

FNMT reported that two intermediate CA certificates issued on 2019-11-28 under the AC RAIZ FNMT-RCM hierarchy lacked the Extended Key Usage extension required by Mozilla Root Store Policy. The affected intermediates are AC Unidades de Sellado de Tiempo and AC Sector Publico, and FNMT said they are used only for non-TLS trust services. FNMT stated that migration to dedicated single-purpose hierarchies is underway and that it requested OneCRL inclusion of the affected intermediates as an interim mitigation. Mozilla later flagged the two certificates as ready to add to OneCRL, but the batch process initially omitted them. FNMT then confirmed on 2026-10-09 that both intermediate CA certificates are now included in OneCRL and that the mitigation action item is complete. FNMT also said the revocation of the two intermediates remains planned for a later stage once there are no remaining valid certificates issued under them.

1. 2019-11-28 FNMT issued two intermediate CA certificates without the required EKU extension.
2. 2026-07-20 FNMT learned of the non-compliant intermediates after an email about a Mozilla dev-security-policy post.
3. 2026-07-22 FNMT opened a preliminary incident report for the missing-EKU intermediates.
4. 2026-08-03 FNMT filed the full incident report and said migration and OneCRL mitigation were in progress.
5. 2026-08-13 FNMT requested OneCRL inclusion for the two affected intermediate CA certificates and confirmed they had not been revoked.
6. 2026-09-30 Mozilla flagged the two intermediate CA certificates as ready to add to OneCRL.
7. 2026-10-02 Mozilla said the batch program omitted the two CAs and would need to be modified or the certificates manually included.
8. 2026-10-09 FNMT said both intermediate CA certificates were now included in OneCRL and updated the action items.

1. 2026-07-22 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT reported the incident, named the two affected intermediate CA certificates, and said migration to dedicated hierarchies had already begun.
2. 2026-07-31 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said the full incident report was still being prepared and would be published by 2026-08-03.
3. 2026-08-03 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT published the full incident report, described the migration plan, and said it would request OneCRL inclusion as an interim mitigation.
4. 2026-08-04 Community commenter — A commenter challenged the planned revocation timeline against the Baseline Requirements for subordinate CA revocation.
5. 2026-08-05 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said the incident concerns remediation of the two non-TLS subordinate CAs and that TLS trust-bit removal is being tracked separately in Bug 2031303.
6. 2026-08-06 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT clarified that this bug documents one part of its broader transition plan and said it will revise CPS wording in a future revision.
7. 2026-08-13 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT requested inclusion of the two intermediate CA certificates in OneCRL as an interim mitigation and confirmed the certificates have not been revoked.
8. 2026-08-20 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said there were no new updates to report.
9. 2026-08-27 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said there were no new developments and that the OneCRL request remains included in the incident for evaluation.
10. 2026-09-30 Mozilla representative — Mozilla said it had flagged the two intermediate CA certificates as ready to add to OneCRL.
11. 2026-10-02 Mozilla representative — Mozilla said the batch program omitted the two CAs and that the batch would need to be modified or the certificates manually included.
12. 2026-10-09 Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) — FNMT said both intermediate CA certificates are now included in OneCRL and asked for the action items to be updated.