← OneCRL Browser

OneCRL Entry

f3762abb-84b6-4908-9bdf-3bc8d0372156

Revocation Entry

Status: disabled
Serial: 187E7F3BF66F23CD
Last Modified: 2025-09-11 18:59:27 UTC
Schema: 1757297740422

Issuer

DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial
DN SHA-256: ce179a08c8bb92549bb52c86134a31983bb3e703c1ce91941d62e6cf130207f1
Issuer DER: MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==

Context

Bugzilla: 1987472
Action: Eleven issuer/serial pairs were proposed for addition to OneCRL by the Common CA Database to OneCRL Bot on 2025-09-08, based on revoked intermediate certificates reported in the CCADB. Ben Wilson confirmed the 11 decoded entries were correct for staging review on 2025-09-08. David Keeler approved them in staging on 2025-09-11 and then approved them in production on 2025-09-11.
Confidence: Explicit in OneCRL thread · 0.96

CCADB Link

Issuer CA: AffirmTrust Commercial
CA Owner: Entrust

AI Summary

Generated 2026-06-30 11:13 UTC · Model: gpt-5.4

Bug 1987472 is a Mozilla OneCRL case automatically created by the Common CA Database to OneCRL Bot on 2025-09-08. The bot stated that it was adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB. The bug proposed 11 issuer/serial OneCRL entries, and Ben Wilson confirmed that the decoded attachment contained the correct 11 entries for review and approval in Kinto Staging. On 2025-09-11, Mozilla staff approved the changes in staging and then in production, and a CCADB incident-reporting account confirmed the changes were correct. The local OneCRL entry data shows the affected certificates were associated with Entrust and AffirmTrust issuers, with CCADB CA owners listed as Entrust or Sectigo. The thread does not state the specific CCADB revocation reason codes, revocation dates, or candidate-report field values for each certificate. The thread also does not state any external compliance incident, CA closure, or separate Bugzilla incident as the cause of the revocations. The entries are now disabled in the provided local OneCRL snapshot, but the bug thread itself documents their addition and approval in September 2025.

OneCRL action

Eleven issuer/serial pairs were proposed for addition to OneCRL by the Common CA Database to OneCRL Bot on 2025-09-08, based on revoked intermediate certificates reported in the CCADB. Ben Wilson confirmed the 11 decoded entries were correct for staging review on 2025-09-08. David Keeler approved them in staging on 2025-09-11 and then approved them in production on 2025-09-11.

CCADB trigger

Explicitly stated as revoked intermediate certificates reported in the CCADB. No specific revocation reason, revocation date, candidate report state, or manual-addition rationale is stated in the thread.

External cause

unknown

Confidence

Explicit in OneCRL thread · 0.96

Chronology

2025-09-08Bug 1987472 was created by the Common CA Database to OneCRL Bot.
2025-09-08Bot stated it was adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.
2025-09-08Attachments were created with issuer/serial pairs and proposed OneCRL additions.
2025-09-08Ben Wilson confirmed the decoded attachment contained the correct 11 OneCRL entries for staging review.
2025-09-09Bot posted that the changes were still in review.
2025-09-10Bot posted that the changes were still in review.
2025-09-11Bot posted that the changes were still in review.
2025-09-11David Keeler approved the 11 changes in staging.
2025-09-11CCADB incident-reporting account said the changes were correct and could proceed to production.
2025-09-11David Keeler approved the changes in production.
2025-09-15Ben Wilson verified the entries were present in local Firefox profiles and at crt.sh/mozilla-onecrl.

Bug 1987472 crt.sh

AI-generated from the OneCRL record and linked Bugzilla thread. Mozilla and CCADB records remain authoritative.

Status	Name	Issuer	Serial	CCADB	Modified
disabled	—	C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority	`008666B02AC1CB54400000000051D3589C`	Entrust Root Certification Authority Sectigo	2025-09-11
disabled	—	C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2	`00AC9A58D8637568D2CDFDDC1C7955CC`	Entrust Root Certification Authority - G2 Sectigo	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC	`0202A584C134064DC9F32D207EA37298`	AffirmTrust Premium ECC Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Commercial	`40F0BBAA8AE0C098`	AffirmTrust Commercial Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Commercial	`53F6A611092E528ED963F19149532204`	AffirmTrust Commercial Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Networking	`3424A1ECF8F0A35FE746B7011C43E844`	AffirmTrust Networking Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Premium	`5371C8EB0784FD5108E5D4F3E323EC46`	AffirmTrust Premium Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Commercial	`187E7F3BF66F23CD`	AffirmTrust Commercial Entrust	2025-09-11
disabled	—	C=US, O=AffirmTrust, CN=AffirmTrust Commercial	`1729551ED68E7FB1EDF57300F35D7FD5`	AffirmTrust Commercial Entrust	2025-09-11
disabled	—	C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2	`7B0350A7B1D46885AF4CC8C740A568B0`	Entrust Root Certification Authority - G2 Sectigo	2025-09-11
disabled	—	C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2	`00FABB27DDFF80D09A0000000051D39440`	Entrust Root Certification Authority - G2 Sectigo	2025-09-11

Raw Remote Settings Record

{
    "schema": 1757297740422,
    "details": {
        "bug": "https://bugzilla.mozilla.org/show_bug.cgi?id=1987472",
        "who": "",
        "why": "",
        "name": "",
        "created": ""
    },
    "enabled": false,
    "issuerName": "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
    "serialNumber": "GH5/O/ZvI80=",
    "id": "f3762abb-84b6-4908-9bdf-3bc8d0372156",
    "last_modified": 1757617167984
}