← OneCRL Browser

Add AC FNMT Usuarios certificate to OneCRL

5e3a7625-ad9e-4713-89e7-3cddd3c0a781

Revocation Entry

Status: disabled
Serial: 455F3AE15C21CDBA544F82AA4751EBDB
Last Modified: 2017-08-21 19:43:01 UTC
Schema: 1552493012878

Issuer

DN: C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM
DN SHA-256: be5b96883f8f6fe7e68b1c846e89ae268f5dd17d7c7c13a778a89a6181d1bca7
Issuer DER: MDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTQ==

Context

Bugzilla: 1391095
Action: Mozilla added the AC FNMT Usuarios intermediate certificate (serial 455f3ae15c21cdba544f82aa4751ebdb, issuer OU AC RAIZ FNMT-RCM) to OneCRL. The request was filed by Kathleen Wilson on 2017-08-16, and Kathleen Wilson explicitly confirmed the addition on 2017-08-23.
Confidence: Explicit in OneCRL thread · 0.95

CCADB Link

Issuer CA: AC RAIZ FNMT-RCM
CA Owner: Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)

AI Summary

Generated 2026-06-30 11:54 UTC · Model: gpt-5.4

Bug 1391095 tracks Mozilla adding the AC FNMT Usuarios intermediate certificate to OneCRL. Kathleen Wilson opened the bug on 2017-08-16 and requested addition of the intermediate, citing a mozilla.dev.security.policy discussion as background. The certificate was explicitly confirmed as added to OneCRL by Kathleen Wilson on 2017-08-23. The thread states that AC FNMT Usuarios was not technically constrained for TLS/SSL issuance and that certificates issued before January 2017 included anyExtendedKeyUsage, while newer ones did not. FNMT initially argued OneCRL revocation was unnecessary because the subCA did not issue TLS/SSL certificates, but later said it had no objection if OneCRL would not affect Firefox client-authentication use. Mozilla stated that adding this intermediate to OneCRL would only affect Firefox TLS/SSL path validation and would have zero impact if the certificate did not sign TLS/SSL certificates. The thread also states that after addition to OneCRL, Mozilla would no longer need annual audit statements asserting non-existence of SSL/TLS certificates for this subCA. A separate bug was then filed for the related AC Representación subCA.

OneCRL action

Mozilla added the AC FNMT Usuarios intermediate certificate (serial 455f3ae15c21cdba544f82aa4751ebdb, issuer OU AC RAIZ FNMT-RCM) to OneCRL. The request was filed by Kathleen Wilson on 2017-08-16, and Kathleen Wilson explicitly confirmed the addition on 2017-08-23.

CCADB trigger

Unknown / not stated in the thread. No CCADB revocation reason, revocation date, or candidate-report state is given; this appears to be a manual OneCRL addition request based on the m.d.s.p. discussion.

External cause

Explicitly tied to the mozilla.dev.security.policy discussion referenced in the bug and OneCRL entry, concerning the AC FNMT Usuarios subCA not being technically constrained for TLS/SSL issuance and older certificates having anyExtendedKeyUsage. No separate CA closure or external compliance incident report is explicitly cited in the thread.

Confidence

Explicit in OneCRL thread · 0.95

Chronology

2017-08-16Kathleen Wilson filed Bug 1391095 requesting addition of AC FNMT Usuarios to OneCRL and linked the m.d.s.p. discussion.
2017-08-21FNMT responded that AC FNMT Usuarios did not issue TLS/SSL certificates and argued OneCRL revocation was unnecessary.
2017-08-21Kathleen Wilson replied that OneCRL only affects Firefox TLS/SSL path validation and would have zero impact if the subCA did not sign TLS/SSL certificates.
2017-08-22Discussion expanded to whether other FNMT subCAs were similarly not technically constrained, including AC Representación.
2017-08-23FNMT stated AC FNMT Usuarios and AC Representación were not technically constrained for TLS/SSL issuance, but said it had no objection to OneCRL inclusion if Firefox client-authentication use would not be affected.
2017-08-23Kathleen Wilson confirmed that AC FNMT Usuarios had been added to OneCRL.
2017-08-23Kathleen Wilson filed Bug 1393281 to add AC Representación to OneCRL and stated Mozilla would no longer need annual audit statements for these subCAs after OneCRL inclusion.

Bug 1392378 Bug 1393281 groups.google.com crt.sh crt.sh crt.sh

AI-generated from the OneCRL record and linked Bugzilla thread. Mozilla and CCADB records remain authoritative.

Status	Name	Issuer	Serial	CCADB	Modified
disabled	Add AC FNMT Usuarios certificate to OneCRL	C=ES, O=FNMT-RCM, OU=AC RAIZ FNMT-RCM	`455F3AE15C21CDBA544F82AA4751EBDB`	AC RAIZ FNMT-RCM Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT)	2017-08-21

Raw Remote Settings Record

{
    "schema": 1552493012878,
    "details": {
        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1391095",
        "who": ".",
        "why": "https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/Qo1ZNwlYKnY/UrAodnoQBwAJ",
        "name": "Add AC FNMT Usuarios certificate to OneCRL",
        "created": "2017-08-17T17:54:25Z"
    },
    "enabled": false,
    "issuerName": "MDsxCzAJBgNVBAYTAkVTMREwDwYDVQQKDAhGTk1ULVJDTTEZMBcGA1UECwwQQUMgUkFJWiBGTk1ULVJDTQ==",
    "serialNumber": "RV864VwhzbpUT4KqR1Hr2w==",
    "id": "5e3a7625-ad9e-4713-89e7-3cddd3c0a781",
    "last_modified": 1503344581693
}