client_domains.rst

Client Domains

This page documents all of domains that Balrog serves, when various applications switched to them, their SSL pinning requirements, and active certificates.

SSL Certificates

Domain	Issuer	Serial Number	Primary/Backup	Expiration	Links	Comments
aus5.mozilla.org	DigiCert	06:27:64:bd:ac:97:4f:2c:0a:50:a8:6c:f3:f9:00:a6	Primary	June 23, 2024	Bug 1834817
		0c:2d:d1:18:c8:57:0e:05:d8:a9:ea:51:7c:ec:d4:10	Retired on May 25, 2023	June 16, 2023	Bug 1768253
		07:01:ce:8f:c6:8d:4a:83:d8:81:db:18:c5:b2:3c:d0	Retired on May 18, 2022	July 4, 2022
		02:39:74:46:BB:F4:1C:48:6B:98:63:A8:54:0B:19:DD	Retired on June 4, 2021	June 16, 2021
		07:10:8B:20:9E:D3:45:6C:EE:88:94:91:44:C4:56:0C	Retired on ????	August 13, 2019		One of these may have been a primary, and the other a backup. This information has been lost to the ether
		0D:23:43:9A:32:3D:25:C5:A6:C3:2D:76:63:60:05:53	Retired on June 14th, 2019	August 13, 2019	Bug 1369143
		07:D5:0D:C7:F3:68:98:2F:AB:5E:19:B9:C5:FB:A1:5C	Retired on July 20, 2017	July 28, 2017	Bug 1179339
	Thawte	0c:96:80:24:b6:b2:72:81:42:8b:53:a5:24:94:52:fb	Retired Backup	August 14, 2020	Bug 1369143
		Unknown	Retired Backup	August 10, 2017	Bug 1179339

Pinning Requirements

Domain	Application	Versions	Issuer Pinned To	HPKP(inning)	Links	Renewable?
aus5.mozilla.org	Firefox	42.0 and up	Nothing	None	Bug 1116409	YES - No pinning requirements for some apps, and we can get certs for those that do pin.
	Fennec
	GMP	101.0 and up	Nothing		Bug 1760527
		42.0 - 100.x	"CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US" "CN=thawte SSL CA - G2,O=thawte, Inc.,C=US"		Bug 1116409
	Thunderbird	51.0 and up	Nothing		Bug 1182352
		42.0 - 50.0	"CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US" "CN=thawte SSL CA - G2,O=thawte, Inc.,C=US"		Bug 1116409
	B2G	Unknown	Nothing
	SystemAddons	44.0 and up	Any CA included in Firefox's root store		Bug 1213348