Client Domains

This page documents all of domains that Balrog serves, when various applications switched to them, their SSL pinning requirements, and active certificates.

SSL Certificates

Domain

Issuer

Serial Number

Primary/Backup

Expiration

Links

Comments

aus5.mozilla.org

DigiCert

0c:2d:d1:18:c8:57:0e:05:d8:a9:ea:51:7c:ec:d4:10

Primary

June 16, 2023

Bug 1768253

07:01:ce:8f:c6:8d:4a:83:d8:81:db:18:c5:b2:3c:d0

Retired on May 18, 2022

July 4, 2022

02:39:74:46:BB:F4:1C:48:6B:98:63:A8:54:0B:19:DD

Retired on June 4, 2021

June 16, 2021

07:10:8B:20:9E:D3:45:6C:EE:88:94:91:44:C4:56:0C

Retired on ????

August 13, 2019

One of these may have been a primary, and the other a backup. This information has been lost to the ether

0D:23:43:9A:32:3D:25:C5:A6:C3:2D:76:63:60:05:53

Retired on June 14th, 2019

August 13, 2019

Bug 1369143

07:D5:0D:C7:F3:68:98:2F:AB:5E:19:B9:C5:FB:A1:5C

Retired on July 20, 2017

July 28, 2017

Bug 1179339

Thawte

0c:96:80:24:b6:b2:72:81:42:8b:53:a5:24:94:52:fb

Retired Backup

August 14, 2020

Bug 1369143

Unknown

Retired Backup

August 10, 2017

Bug 1179339

Pinning Requirements

Domain

Application

Versions

Issuer Pinned To

HPKP(inning)

Links

Renewable?

aus5.mozilla.org

Firefox

42.0 and up

Nothing

None

Bug 1116409

YES - No pinning requirements for some apps, and we can get certs for those that do pin.

Fennec

GMP

101.0 and up

Nothing

Bug 1760527

42.0 - 100.x

“CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US”
“CN=thawte SSL CA - G2,O=thawte, Inc.,C=US”

Bug 1116409

Thunderbird

51.0 and up

Nothing

Bug 1182352

42.0 - 50.0

“CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US”
“CN=thawte SSL CA - G2,O=thawte, Inc.,C=US”

Bug 1116409

B2G

Unknown

Nothing

SystemAddons

44.0 and up

Any CA included in Firefox’s root store

Bug 1213348