1017583 - Public disclosure of GlobalSign Subordinate CAs

Status: RESOLVED WORKSFORME

(CA Program :: CA Certificate Root Program, task)

Description

[Steve Roylance]

Attachment: GlobalSign Subordinate CAs - Disclosed.zip

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; InfoPath.3; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; rv:11.0) like Gecko

Steps to reproduce:

This bug is being raised following the instructions in the Inclusion Policy to disclose all CAs which are not technically constrained.


Actual results:

n/a


Expected results:

n/a

Comment 1

[Steve Roylance]

The inclusion policy requires
◦The full DER-encoded X.509 certificate (Each issuing CA should provide one .p7c, .zip, or .tgz file containing all of the non-technically-constrained intermediate certificates that it has signed.);

Done (attached to this bug in DER format with all files in a zip)

◦The corresponding Certificate Policy or Certification Practice Statement used by the subordinate CA; and

Our current CP/CPS is located here:-
https://www.globalsign.com/repository/GlobalSign_CP_v4.6.pdf 
https://www.globalsign.com/repository/GlobalSign_CA_CPS_v7.6.pdf

◦Annual public attestation of conformance to the stated certificate verification requirements and other operational criteria by a competent independent party or parties with access to the details of the subordinate CA’s internal operations.

Our current WebTrust Audit is ongoing April through May and we expect the next Site seal in late June.  For now here are the links.
https://cert.webtrust.org/SealFile?seal=1511&file=pdf WebTrust for CA
https://cert.webtrust.org/SealFile?seal=1515&file=pdf Baseline Requirements
https://cert.webtrust.org/SealFile?seal=1514&file=pdf EV

Comment 2

[Kathleen Wilson]

Closing this bug as resolved, but this bug will continue to be used to provide information about GlobalSign's publicly disclosed and audited subordinate CAs, as per item #10 of 
http://www.mozilla.org/about/governance/policies/security-group/certs/policy/inclusion/

Comment 3

[Steve Roylance]

Attachment: Mozilla - List of Issuing CAs from GlobalSign.xlsx

All CA's from GlobalSign are now either used internally as our own products, Technically constrained or in CRL mode only and within 10 months of being revoked as the final certificates issued by these CAs head towards expiry.  The attached XLS provides details of the CAs and Thumbprints as of March 2015.   New CAs have been added from the original list however the majority of these are name constrained and are therefore not disclosed.  The new CAs will be added via another ZIP file as the next attachement

Comment 4

[Steve Roylance]

Attachment: Mozilla - List of Issuing CAs from GlobalSign March 2015.xlsx

Updated list with unconstrained above and constrained below

Comment 5

[Steve Roylance]

Attachment: GlobalSign Subordinate CAs - Disclosed.zip