In October 2016, Mozilla announced that, as of Firefox 51, we would stop validating new certificates chaining to the root certificates listed below that are owned by the companies WoSign and StartCom.
The announcement also indicated our intent to eventually completely remove these root certificates from Mozilla’s Root Store, so that we would no longer validate any certificates issued by those roots. That time has now arrived. We plan to release the relevant changes to Network Security Services (NSS) in November, and then the changes will be picked up in Firefox 58, due for release in January 2018. Websites using certificates chaining up to any of the following root certificates need to migrate to another root certificate.
This announcement applies to the root certificates with the following names:
- CA 沃通根证书
- Certification Authority of WoSign
- Certification Authority of WoSign G2
- CA WoSign ECC Root
- StartCom Certification Authority
- StartCom Certification Authority G2
Mozilla Security Team