20221006 - Mozilla modifies its roots management policy

Mozilla recently announced a change in its roots management policy. That policy determines if a root can be stored by the company's browsers.

Roots that don't meet the policy are removed.

A root life's cycle

Mozilla decided to limit the use of a root to 10 years. In doing so, Mozilla hopes to encourage cryptographic agility, address advancements in computing, and facilitate the transition to better algorithms.

It is also warranted because older roots may have been created with older technologies, policies, and practices that are not in use anymore.

Consequences

Those changes will lead to the suppression of roots that are more than 15 years old from Mozilla stores as of 2025 according to a precise calendar:

Case of S/MIME certificates

The same rules apply for S/MIME roots except that they can be used for 18 years after their creation.

A specific calendar will be followed. It will start in 2028:

Why 15 years?

A root inclusion is a long process that takes 2 to 3 years. Then a transition period is needed to switch from an old to a new root. Therefore, a 15-year term allows for approximately 10 years of root CA use within the Mozilla root store.

What impact for your certificates?

An older root is often widely recognized and offers a better recognition to your certificates. Switching for a newer one will impact the browser's ubiquity for your SSL certificates.

All DV, OV and EV certificates issued on a SHA1 root are concerned.

List of impacted roots

Useful links

• Mozilla communication
• Mozilla - CA/Root CA Lifecycles