CA Distrust (Distrust)

CA distrust is the strongest sanction a root program can apply. It ranges from removing a root from the trust store, which breaks every certificate under it, to a partial distrust that keeps existing certificates working but rejects new ones, often judged by the timestamp of the earliest SCT because a CA cannot backdate a time signed by a CT log. Decisions typically follow sustained compliance failures, misissuance or compromise.

Why it matters

Well-known cases show the pattern. Symantec: Chrome 66 (April 2018) distrusted Symantec certificates issued before 2016-06-01, and Chrome 70 (October 2018) distrusted the old Symantec PKI entirely. Entrust: Chrome 131+ distrusts Entrust TLS certificates whose earliest SCT is after 2024-11-11; Mozilla's cut-off was 2024-11-30 and Apple's 2024-11-15; Sectigo later acquired Entrust's public certificate business (announced 2025-01-29). Chunghwa Telecom and NetLock: Chrome 139+ distrusts their certificates with SCTs after 2025-07-31. eMudhra: on 2026-10-20 Google and Mozilla confirmed compromised eMudhra intermediate CAs, and Chrome removed the "emSign ECC Root CA - G3" root, rolled out on 2026-10-27. A CA choice is therefore never permanent; keep automation able to switch CAs.

Example

A site renews with an affected CA after the cut-off date. Visitors on the distrusting browser see NET::ERR_CERT_AUTHORITY_INVALID, while the CA's older certificates, and other browsers, still work, which makes the failure confusing to diagnose.

Common misconceptions

• Distrust immediately breaks all of a CA's certificates. Partial distrust leaves certificates issued before the cut-off working until they expire.
• Buying from a reseller protects you. Resellers sell certificates from an underlying CA; if that CA is distrusted, so are the certificates.
• Distrust follows a single mistake. Most cases follow a pattern of incidents and poor responses, or a serious compromise.