← Certigna cases
Bugzilla #2081248
Trust Bit Disablement
Ccadb Metadata Update
Information Request
Certigna requests removal of websites trust bit and unneeded 2024–2025 root records
ASSIGNED
Certigna
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Certigna asked Mozilla to update CCADB records after it stopped issuing publicly trusted TLS server certificates on 2026-06-13. The request was to remove the Server authentication trust bit for the Certigna and Certigna Root CA roots, and to remove several 2024–2025 root CAs that were never intended to issue publicly recognized certificates. Mozilla asked whether any unexpired TLS server certificates remained under the affected roots and explained that, if none remained, the websites trust bit could be removed directly. Certigna then confirmed that all TLS server certificates issued under these CA certificates had expired and said the websites trust bit can be removed. The bug remains assigned and no final closure is shown in the thread.
Chronology
- Certigna stopped issuing publicly trusted TLS server certificates.
- Certigna requested removal of the Server authentication trust bit and removal of several unneeded root CA records.
- Certigna confirmed that all TLS server certificates under the affected CA certificates had expired.
Thread Activity
- Dhimyotis representative — Certigna asked Mozilla to remove the Server authentication trust bit for Certigna and Certigna Root CA and to remove several 2024–2025 root CA records from CCADB.
- Mozilla representative — Mozilla asked Certigna to confirm whether any unexpired TLS server certificates remained and explained the difference between removing the trust bit directly and first setting a distrust-after date.
- Dhimyotis representative — Certigna confirmed that all TLS server certificates had expired and that the websites trust bit can be removed.
Participants
Dhimyotis representative
Mozilla representative
External References
Similar Local Cases
Amazon Trust Services: Request EV Trust Bit Removal
Request to disable SMIME "trust bit" for GoDaddy CAs
Turn off Secure Email Trust Bit for certSIGN ROOT CA G2 cert
Turn off Secure Email Trust Bit for certSIGN ROOT CA cert
Remove the Email (S/MIME) trust bit for ePKI Root Certification Authority
Turn off websites and code signing trust bits for two IdenTrust root certs
PKIoverheid: Removal of websites trust bit for "Staat der Nederlanden Root CA – G3"
Turn off Websites trust bit for OpenTrust and Certplus root certs