Mozilla moves to remove NetLock from its root store.

What Mozilla proposes

Ben Wilson, Mozilla's Root Program Manager, announced the issues list on dev-security-policy:

“The Netlock Issues List is subject to correction and amendment and will serve as the basis for removing trust in Netlock’s CA certificates from the Mozilla Root Store. Our concern centers on the recurring nature of Netlock’s failures documented in the list, including delayed responses and incident updates, inadequate investigation and remediation, disclosure deficiencies, and failures affecting certificate issuance and revocation services.”

— Mozilla, dev-security-policy, 4 November 2026

“The date, time, and manner of trust removal have not been determined”: Mozilla will announce them separately, after it considers responses sent to the list or to certificates@mozilla.org by 13 November 2026. The proposal does not say whether trust would end at once or only for certificates issued after a cut-off date.

Independently of the proposal, Mozilla had already scheduled the websites trust bit of NetLock's root to be removed on 15 April 2027 under its root age policy (Mozilla root lifecycles). The root itself expires on 6 December 2028.

The issues

The Netlock Issues List collects NetLock's public compliance record in Mozilla's Bugzilla, where 48 NetLock incident reports have been filed since 2017. Its summary:

“The central concern is Netlock’s ability to sustain effective controls across its publicly trusted CA operations.”

The list is grouped into ten issues:

• Repeated failures to post incident updates and answer questions, in 2018–2019 and again in 2024–2026.
• Certificate problem reports not handled within 24 hours, in 2024 and again in June 2026, when the first substantive reply came about 16 days after the report.
• Late initial and full incident reports.
• Revocations delayed for subscribers' reasons in 2020, 2023 and 2024.
• Misissuance: common names missing from the SAN list, precertificates valid for more than 398 days, OU fields, prohibited policy qualifiers.
• Late disclosure of four intermediate CAs in the CCADB in 2024, and recurring errors in disclosed CRL URLs.
• Revocation data: stale and PEM-encoded CRLs, a recurring reasonCode defect, and CRLs that reused one CRL number with different contents.
• Publication and status services: AIA served as PEM, OCSP answering “unknown” for an issued certificate for about 11 days.
• Findings in the 2024 audit.
• Still under investigation: a precertificate signing CA in use after such CAs were prohibited on 15 March 2026, and lagging CP/CPS disclosure.

Where the browsers stand

After Chrome's decision NetLock said it was “working to regain trust” and that after 31 July 2025 its TLS certificates “will be provided by NETLOCK's partners” (NetLock).

Timeline

• 2017-08-16 First NetLock incident in Mozilla's Bugzilla. — Bugzilla 1391056
• 2024-11-15 Apple's distrust of the Gold root takes effect. — Apple
• 2025-05-30 Chrome announces it will distrust NetLock TLS certificates whose earliest SCT is after 31 July 2025. — CCADB public
• 2025-06-12 NetLock says its TLS certificates will be provided by partners after 31 July 2025. — NetLock
• 2026-05-06 Mozilla schedules the removal of the root's websites trust bit for 15 April 2027 under its root age policy. — dev-security-policy
• 2026-08-17 The Gold root is removed from the Chrome Root Store. — Chromium
• 2026-10-02 “Netlock inclusion in MRSP” is raised on dev-security-policy; Mozilla replies that it is considering the concerns. — dev-security-policy
• 2026-11-04 Mozilla publishes the Netlock Issues List and proposes removal. — dev-security-policy
• 2026-11-13 Deadline for responses. — dev-security-policy

NetLock's TLS CAs

One NetLock root is in the Mozilla Root Store, and NetLock names three intermediates under it as issuing TLS certificates. Each links to its page in our index, with the certificates it issued.

What Certificate Transparency shows

Our index holds 332 TLS certificates from the three CAs issued since December 2024 (older ones have expired and are counted only in our archive). Chrome's cut-off is the earliest SCT: a certificate first logged on or after 1 August 2025 is not trusted in Chrome.

Until July 2025 the three CAs issued 22 to 53 certificates a month. In August 2025, when Chrome stopped trusting new NetLock certificates, issuance all but stopped: one certificate in August, none in September or October, one in November. Since December 2025 it has run at six to eleven a month.

Those later certificates are almost all NetLock's own. Every certificate first logged after Chrome's cut-off, by name:

The names on tanusitvany.hu are NetLock's test websites, which the Baseline Requirements oblige a CA to run, with a valid, a revoked and an expired certificate for each root, so that software vendors can test against them; the CCADB lists valid.ev.tanusitvany.hu and revoked.ev.tanusitvany.hu as the test sites of NetLock's root. NetLock renews them every month with 30-day certificates. nsi.netlock.hu and *.local.netlock.com are NetLock's own domains. One certificate went to a customer: vapp.gravitacio.hu, issued to GRAVITÁCIÓ Kft. on 19 August 2025 and expired on 19 August 2026.

All 7 TLS certificates from these CAs that are valid on 2026-11-07 belong to NetLock. As far as Certificate Transparency shows, removing NetLock from the Mozilla Root Store would not take a single customer website out of Firefox's trust: the record is consistent with NetLock's 2025 statement that its partners now provide its customers' TLS certificates. What NetLock's TLS CAs still issue is their own test infrastructure.

Sources

• Netlock Issues List: Near-Final Draft and Proposed Removal from the Mozilla Root Store, dev-security-policy, 4 November 2026
• Netlock Issues List, Mozilla wiki
• Netlock inclusion in MRSP, dev-security-policy, October 2026
• Chrome Root Program announcement, 30 May 2025
• Apple: blocked trust for NetLock
• NetLock: important change for SSL certificates, 12 June 2025
• CCADB: Mozilla included roots and intermediates

Published 7 November 2026 by ctlogs.dev. Certificate data as of 2026-11-07, from our Certificate Transparency index.