Confirm, administrator
5,526
edits
Changes
→Disable a Root
=== Disable a Root ===
Disabling a root is the act of turning off one or more of the three trust bits (websitesWebsites, emailEmail, code signingCode Signing).
Reasons for disabling a root certificate may include, but are not limited to:
#*** Impact that the change may have on Mozilla users
#** An authoritative representative of the CA must approve the change.
# The bug will be assigned to the Mozilla representative who is appointed to evaluate the request. #* This will normally usually be the standing module owner.
# The Mozilla representative will ensure the necessary information has been provided.
#* Options should be identified
#* Outline is presented, references to full bug provided
#* Deadline for discussion is set
#* [http://www.mozilla.org/projects/security/security-bugs-policy.html Security-sensitive] requests for root removal changes would be discussed primarily within the (closed) Mozilla security group. However others could be added to the discussion by explicitly cc-ing them on the bug. # The Mozilla representative will summarize the discussion and communicate the Decisions and summarize decisions in the bug.#* Decision to remove (or not)
#* Decision about which Trust Bits to unset
#* Any other options or actions as decided
# Implementation
#* If the resulting decision is to change the root certificate, the Mozilla representative will create a corresponding NSS bug to make the actual changes in NSS, and mark that bug as blocking the original change request bug.
#* A Mozilla representative creates a test build of NSS with the change to the root certificate, and attaches nssckbi.dll to the bug. A representative of the CA or of Mozilla must download this, drop it into a copy of Firefox and/or Thunderbird and confirm (by adding a comment in the bug) that the certificate has been correctly changed.
#* A Mozilla representative checks the changes into the NSS store, and marks the bug RESOLVED FIXED.
