← OneCRL Browser

Revoked intermediates

6c0561bc-fea3-ba35-bbdb-2b2672b67d36

Revocation Entry

Status: enabled
Serial: 040000000001220D3C14C5
Last Modified: 2017-01-03 19:23:13 UTC
Schema: 1552493021474

Issuer

DN: OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
DN SHA-256: ab7786af67db7a0bc66c0f395160867c9df3fc7f3a124282122a662f1b4dc424
Issuer DER: MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu

Context

Bugzilla: 1315199
Action: A large batch of revoked intermediate certificate entries was added to OneCRL. The action was initiated in Bugzilla by Mark Goodwin through attached blocklist files generated from CCADB data, reviewed for addition by Kathleen Wilson, canary-tested by Matt Wobensmith, and executed by J. Thomas. Stage addition was reported on 2017-01-03 at 18:36:27Z and production addition was reported on 2017-01-03 at 18:42:40Z; the local OneCRL entries show creation timestamps between 2017-01-03T18:41:52Z and 2017-01-03T18:41:55Z.
Confidence: Explicit in OneCRL thread · 0.95

CCADB Link

Issuer CA: GlobalSign
CA Owner: Google Trust Services LLC

AI Summary

Generated 2026-06-30 11:48 UTC · Model: gpt-5.4

Bug 1315199 tracks a bulk addition of revoked intermediate certificate entries to Mozilla OneCRL. Mark Goodwin opened the bug on 2016-11-04 and attached blocklist entries generated from CCADB data, later adding a second attachment with more entries on 2016-11-24. Kathleen Wilson explicitly reviewed both attachment sets and stated that all of the listed blocklist entries should be added to OneCRL. A canary run was requested and Matt Wobensmith reported on 2016-12-12 that the revocations looked good with no errors on about 290,000 sites from the Alexa top 1 million. On 2017-01-03, J. Thomas reported the entries were added on stage and then to production, and the local OneCRL records show the resulting entries were created around 2017-01-03T18:41:52Z to 18:41:55Z and last modified around 19:23:12Z to 19:23:14Z. The thread does not state per-certificate CCADB revocation reasons, revocation dates, or candidate-report states. The bug also does not state a single external compliance incident or CA closure explaining the listed revocations; it appears to be a bulk import of CCADB-derived revoked intermediates from multiple CA owners.

OneCRL action

A large batch of revoked intermediate certificate entries was added to OneCRL. The action was initiated in Bugzilla by Mark Goodwin through attached blocklist files generated from CCADB data, reviewed for addition by Kathleen Wilson, canary-tested by Matt Wobensmith, and executed by J. Thomas. Stage addition was reported on 2017-01-03 at 18:36:27Z and production addition was reported on 2017-01-03 at 18:42:40Z; the local OneCRL entries show creation timestamps between 2017-01-03T18:41:52Z and 2017-01-03T18:41:55Z.

CCADB trigger

Explicitly CCADB-derived bulk entries, but the thread does not state the specific CCADB revocation fields, revocation reasons, revocation dates, candidate-report status, or whether qualification depended on a particular report state for each certificate.

External cause

Unknown / not stated. No single external compliance incident, root program report, mailing list thread, or CA closure is identified in the OneCRL bug thread as the cause of these revocations.

Confidence

Explicit in OneCRL thread · 0.95

Chronology

2016-11-04Mark Goodwin filed Bug 1315199 and attached initial blocklist entries for addition to the AMO cert blocklist.
2016-11-04A sample revocations.txt file for compatibility testing was attached.
2016-11-08Kathleen Wilson stated that all entries in the first attachment should be added to OneCRL.
2016-11-24Mark Goodwin attached an additional set of blocklist entries and an updated sample revocations.txt.
2016-11-28Kathleen Wilson stated that all additional blocklist entries should be added to OneCRL.
2016-11-29Kathleen Wilson requested a canary run before adding the entries to OneCRL.
2016-12-12Matt Wobensmith reported the canary run looked good with no errors on about 290k Alexa top 1M sites.
2017-01-03J. Thomas reported the entries were added on stage and looked good.
2017-01-03J. Thomas reported the entries were done on production.

Bug 1312150 Bug 1315199 blocklist.allizom.org

AI-generated from the OneCRL record and linked Bugzilla thread. Mozilla and CCADB records remain authoritative.

Status	Name	Issuer	Serial	CCADB	Modified
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3	`4AEADDB5FB2E3DC5D70E96362E406960EE814FBA`	QuoVadis Root CA 3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3	`12BD26A2AE33C07F247B6A5869F20A76`	VeriSign Class 3 Public Primary Certification Authority - G3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root	`07276202`	Baltimore CyberTrust Root DigiCert	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`78BBA60D43B8D0AC2779C64B27114CD8`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`07`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2	`1A93B8F1A27C1A782DC040AA6619BFC4`	Swisscom Root CA 2 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=NL, O=Digidentity B.V., CN=Digidentity Organisatie CA - G2	`0B`	Digidentity Organisatie CA - G2 Government of The Netherlands, PKIoverheid (Logius)	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`20`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA	`39F24122117001D4`	Actalis Authentication Root CA Actalis	2017-01-03
enabled	Revoked intermediates	C=US, O=SecureTrust Corporation, CN=SecureTrust CA	`3000494C`	SecureTrust CA SSL.com	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`1C`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=NL, O=Digidentity B.V., CN=Digidentity Burger CA - G2	`0C`	Digidentity Burger CA - G2 Government of The Netherlands, PKIoverheid (Logius)	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3	`08B7`	QuoVadis Root CA 3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=US, O=SecureTrust Corporation, CN=Secure Global CA	`40002711`	Secure Global CA SSL.com	2017-01-03
enabled	Revoked intermediates	C=US, O=GeoTrust Inc., CN=GeoTrust Global CA	`023A8A`	GeoTrust Global CA DigiCert	2017-01-03
enabled	Revoked intermediates	C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root	`0727CD78`	Baltimore CyberTrust Root DigiCert	2017-01-03
enabled	Revoked intermediates	C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki@sk.ee	`24B883CE0A4BEE814D80937E8C88EDEF`	EE Certification Centre Root CA SK ID Solutions AS	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3	`07022679A46449940B6301511302A8DD1D499FEF`	QuoVadis Root CA 3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1	`1F14F55D28C8A738CCA6BA7D42ED6061`	Swisscom Root CA 1 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority	`4038B9B0`	XRamp Global Certification Authority SSL.com	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`04`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki@sk.ee	`2AECC73C92DD2B984D809468DD1E3B02`	EE Certification Centre Root CA SK ID Solutions AS	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3	`07E5`	QuoVadis Root CA 3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root	`07279AAB`	Baltimore CyberTrust Root DigiCert	2017-01-03
enabled	Revoked intermediates	C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki@sk.ee	`2D4E1DD2DECF02C64D80919971BFA8FF`	EE Certification Centre Root CA SK ID Solutions AS	2017-01-03
enabled	Revoked intermediates	OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign	`040000000001220D3C14C5`	GlobalSign Google Trust Services LLC	2017-01-03
enabled	Revoked intermediates	C=US, O=GeoTrust Inc., CN=GeoTrust Global CA	`023A8B`	GeoTrust Global CA DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`15`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=IE, O=Baltimore, OU=CyberTrust, CN=Baltimore CyberTrust Root	`0727489F`	Baltimore CyberTrust Root DigiCert	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1	`243D70C4377C2209A2A97ECCC8F3E0D6`	Swisscom Root CA 1 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority	`421FD2A8`	QuoVadis Root Certification Authority DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis - Root CA	`27C9B39F1BD3BCE479A7806BDDADEC9B98F988CD`	Certinomis - Root CA Docaposte Certinomis SAS	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2	`0080A1A5B18DAAEE172A9F49EF4B32284B`	Swisscom Root CA 2 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3	`0A3D`	QuoVadis Root CA 3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`03`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign	`040000000001444EF0464E`	GlobalSign Google Trust Services LLC	2017-01-03
enabled	Revoked intermediates	C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority	`4038B9B1`	XRamp Global Certification Authority SSL.com	2017-01-03
enabled	Revoked intermediates	C=IT, L=Milan, O=Actalis S.p.A./03358520967, CN=Actalis Authentication Root CA	`589DAA1F3594A939`	Actalis Authentication Root CA Actalis	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`554B5A84EC2FBE6245C25BE618364FE7`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`2F57C7A20B15C667CC0646B9AB8BB369`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=EE, O=AS Sertifitseerimiskeskus, CN=EE Certification Centre Root CA, emailAddress=pki@sk.ee	`709FAF838EF8D9784D8095B6A2DF5E22`	EE Certification Centre Root CA SK ID Solutions AS	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`2E2CDE5971563F9A593C8FDD2DCF8F55`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`13`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign	`0400000000011256AD5FB2`	GlobalSign Google Trust Services LLC	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 2	`00D5FC4A7351C429AC13F182979870FBC0`	Swisscom Root CA 2 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`54149FF889DCB130774594B82850893D`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=NL, O=Digidentity B.V., CN=Digidentity Organisatie CA - G2	`0C`	Digidentity Organisatie CA - G2 Government of The Netherlands, PKIoverheid (Logius)	2017-01-03
enabled	Revoked intermediates	C=US, OU=www.xrampsecurity.com, O=XRamp Security Services Inc, CN=XRamp Global Certification Authority	`4038B9AF`	XRamp Global Certification Authority SSL.com	2017-01-03
enabled	Revoked intermediates	C=US, O=SecureTrust Corporation, CN=SecureTrust CA	`3000494B`	SecureTrust CA SSL.com	2017-01-03
enabled	Revoked intermediates	C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1	`12B9B0B6`	Security Communication RootCA1 SECOM Trust Systems CO., LTD.	2017-01-03
enabled	Revoked intermediates	C=BE, CN=Belgium Root CA2	`35B73AF10F041F36BBD8FFE149671D77`	Belgium Root CA2 GlobalSign nv-sa	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`22`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=TW, O=Government Root Certification Authority	`00F74279BABC67266BFD3D25BB196270DC`	Government Root Certification Authority Government of Taiwan, Government Root Certification Authority (GRCA)	2017-01-03
enabled	Revoked intermediates	C=JP, O=SECOM Trust.net, OU=Security Communication RootCA1	`12B9B0D1`	Security Communication RootCA1 SECOM Trust Systems CO., LTD.	2017-01-03
enabled	Revoked intermediates	C=US, O=GeoTrust Inc., CN=GeoTrust Global CA	`023A7F`	GeoTrust Global CA DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`17`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=TW, O=Government Root Certification Authority	`2B57EDB68ED771BD182B043AB8CBCE20`	Government Root Certification Authority Government of Taiwan, Government Root Certification Authority (GRCA)	2017-01-03
enabled	Revoked intermediates	C=CN, O=CNNIC, CN=CNNIC ROOT	`49330015`	CNNIC ROOT China Internet Network Information Center (CNNIC)	2017-01-03
enabled	Revoked intermediates	C=ch, O=Swisscom, OU=Digital Certificate Services, CN=Swisscom Root CA 1	`53ED58D50A4973414E47925D089D3581`	Swisscom Root CA 1 Swisscom (Switzerland) Ltd	2017-01-03
enabled	Revoked intermediates	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3	`4C00361BE5082BA9AACE740A053EFB34`	VeriSign Class 3 Public Primary Certification Authority - G3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`23`	Certigna Certigna	2017-01-03
enabled	Revoked intermediates	C=BM, O=QuoVadis Limited, OU=Root Certification Authority, CN=QuoVadis Root Certification Authority	`421FCEE7`	QuoVadis Root Certification Authority DigiCert	2017-01-03
enabled	Revoked intermediates	C=US, O=GeoTrust Inc., CN=GeoTrust Global CA	`023A7E`	GeoTrust Global CA DigiCert	2017-01-03
enabled	Revoked intermediates	C=JP, O=Fuji Xerox, CN=Fuji Xerox Certification Authority 2	`0146B8ECF390D5D379`	Fuji Xerox Certification Authority 2 SECOM Trust Systems CO., LTD.	2017-01-03
enabled	Revoked intermediates	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 1999 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G3	`3E0C9E8769AA955CEA23D8459ED45B51`	VeriSign Class 3 Public Primary Certification Authority - G3 DigiCert	2017-01-03
enabled	Revoked intermediates	C=FR, O=Dhimyotis, CN=Certigna	`1A`	Certigna Certigna	2017-01-03

Raw Remote Settings Record

{
    "schema": 1552493021474,
    "details": {
        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1315199",
        "who": ".",
        "why": ".",
        "name": "Revoked intermediates",
        "created": "2017-01-03T18:41:53Z"
    },
    "enabled": true,
    "issuerName": "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
    "serialNumber": "BAAAAAABIg08FMU=",
    "id": "6c0561bc-fea3-ba35-bbdb-2b2672b67d36",
    "last_modified": 1483471393889
}