What's the purpose of shipping Firefox with expired root certs?

I checked and there are two expired certs listed. In fact the company's website for the first expired cert (A-Trust) states that the new one needs to be imported manually. Why isn't it immediately shipped with Firefox? Why are the expired certs still included in Firefox?

  • Possible explanation: Replacing root certificates is a process that costs time and the guys at Mozilla didn't find the time (yet). Other possible cause: Maybe root certificates are only ever updated with a specific version change of NSS and it doesn't receive those too often. (both points are speculation though) – SEJPM Dec 27 '15 at 22:27
  • A-Trust paperwork seems to be lacking. See the bug report linked from the Mozilla CA schedule wiki page. – StackzOfZtuff Dec 28 '15 at 7:36

Mozilla policy?

I think there is probably less of a technical answer to that. And more of a Mozilla policy answer.

Trust stores have certain rules about how you can get your root CAs into and out of it.

Mozilla also has such rules. I don't completely understand them.

But the general idea is that once your root is inside the Mozilla trust store the regular way you can get thrown out is via a two step process: first your root is left in the trust store, but placed in "deprecated" status. And after your root has been in deprecated status you may then be thrown out completely.

If on the other hand you already have a root CA in the Mozilla trust store and only want to renew it, then the rules are slightly different than if you had no root CAs there. (Not sure about that part.) They have a special section on the wiki named Requests from Already Included CAs that are in or Ready for Discussion -- and A-Trust is listed there.

And what I think is the case here is that "A-Trust" has a root in the store from earlier on but their renewal efforts have not really worked yet. They're still stuck in that process.

Also: While expiration dates may not be a technical reason for exclusion from a trust store, expiration certainly is a reason according to Mozilla policy.


Trust anchors like root certificates are only trusted because they are included as trusted by the system or browser. There are no additional validations like checking for revocation or expiration. Thus it does not matter much if the root certificate itself is expired but only the expiration dates of the certificates directly or indirectly signed by this root are relevant.

For the validation of the trust chain the public key inside the root certificate is the most important part, because it is needed to validate the signature of the issued certificate. Often you will find multiple versions of the same CA certificate which all share the same public key and subject but which have different expiration dates, signature algorithms or issuers (i.e. some are self-signed, some are signed by another CA). All of these can be used equally as a trust anchor because they share key and subject so it actually does not matter that one has the newest version in the trust store.


Another reason: Mozilla apps use certificates to verify the digital signatures of extensions (or other stuff you throw at NSSAPI). The signatures should continue to be verifiable long after the signing certificate (and the root certificate of which) expires. The root has to be retained so the CRL/OCSP can still be accessed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.