TLS-specific and S/MIME-specific Root CAs

[BenWilson-Mozilla]

According to MRSP section 5.3, Intermediate CA certificates created after January 1, 2019, MUST NOT include both the id-kp-serverAuth and id-kp-emailProtection KeyPurposeIds in the same certificate. However, the MRSP is silent on whether the same principle should be applied to root certificates. A question has been raised regarding when Mozilla might require the submission of TLS-specific or S/MIME-specific root CA certificates for inclusion. If such a requirement is planned, we need clarification on what the policy will be and the timeline for its implementation

[BenWilson-Mozilla]

See post here: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/jzgUi8OHyhI/m/PqNUxoP1AQAJ