Basic Constraint Extension (BCE) fix: remove old Entrust 2048 root and add replacement intermediate

This case concerns an Entrust 2048 root certificate in Mozilla’s root store that lacks a “Basic Constraint Extension” (BCE), which was causing problems for an application consuming the Mozilla root list. The reporter proposed removing the old root certificate (serial 0x3863b966) and adding a replacement intermediate certificate (serial 0x469e911a) that contains the correct BCE. Entrust confirmed it had re-issued a certificate to address the BCE issue and said it started the process to include the replacement in Mozilla, but that the process was not completed due to actions required by Entrust. Entrust also referenced another Mozilla request (bug 694536) as the related process and discussed timing considerations for trust changes. Kathleen Wilson asked about the time frame and suggested separating the root replacement request from an unrelated new root request in bug 694536. The bug was ultimately resolved as a duplicate of bug 694536 because the replacement plan in that other bug made this proposal unnecessary.

1. 2013-03-11 Reporter proposed replacing an Entrust 2048 root lacking BCE with a BCE-correct replacement intermediate in Mozilla’s root store.

1. 2013-03-11 Kuix representative — Reported that a specific Entrust root certificate in Mozilla’s store lacks BCE and proposed removing the old root and adding a replacement intermediate with BCE.
2. 2013-03-11 Kuix representative — Asked Entrust for comments on the proposal, including whether Entrust had issued still-valid certificates using the old root and how long the old root would need to remain valid.
3. 2013-03-11 Entrust representative — Confirmed Entrust had re-issued the certificate with the correct BCE, said inclusion in Mozilla was started but not completed due to Entrust actions, and referenced bug 694536 as the request.
4. 2013-03-11 Mozilla representative — Asked for a time frame and suggested separating the root replacement request from an unrelated new root request in bug 694536 to resolve the BCE issue first.
5. 2013-03-11 Kuix representative — Agreed to separate the root replacement request and finish the approval process to resolve the issue for a product scheduled to ship in June 2013.
6. 2013-03-11 Kuix representative — Resolved the bug as a duplicate of bug 694536 because the replacement plan there made this proposal unnecessary.