1024418 - Please add Signet/Orange Root CA certificate

Status: RESOLVED WONTFIX

(CA Program :: CA Certificate Root Program, task)

Description

[Jerzy Rudowski]

Attachment: General information about the Orange Signet Certification Authority

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20140212131424

Steps to reproduce:

Orange Polska provides PKI public certification services for its custormers under the brand name "Signet CC". Services are "WebTrust for CAs" certified, but issued end-entity certificates are not recognized as trusted in Mozilla products. Please, see e.g.:

https://ssl-test.signet.pl 



Actual results:

Certificate is not recognized as trusted and warning message is displayed.


Expected results:

Certificate should be recognized as trusted. Please, include Signet root certificate into Mozilla products.

Please find required information in attached file.

Comment 1

[Jerzy Rudowski]

Attachment: rootca_der.cer

Signet Root CA certificate in .DER format.

Comment 2

[Kathleen Wilson]

I am accepting this bug, and will work on it as soon as possible, but I have a large backlog.
https://wiki.mozilla.org/CA:Schedule#Requests_in_the_Information_Gathering_and_Verification_Phase

I will update this bug when I begin the Information Verification phase.
https://wiki.mozilla.org/CA:How_to_apply#Information_Verification

Comment 3

[Kathleen Wilson]

Attachment: Initial CA Information Document

The attached document summarizes the information that has been verified.

The items highlighted in yellow indicate where further information or
clarification is needed. Please review the full document for accuracy and
completeness, and provide the necessary information in this bug.

Comment 4

[Jerzy Rudowski]

(In reply to Kathleen Wilson from comment #3)

In attached document "General information about the Orange Signet Certification Authority UPDATED" I  have clarified/added some requested information.

Since currently Signet CC is not fully compliant with CAB Forum requirements, not all issues are addressed yet. 

I will inform you as soon as all requirements are fulfilled.

Comment 5

[Jerzy Rudowski]

Attachment: Updated information about the Orange Signet Certification Authority

All updated/added information is highlighted in yellow.

Comment 6

[Kathleen Wilson]

Thank you for the update and for the translated documents.

Please comment in this bug when OCSP and the BR audit statement are available.

Comment 7

[Jerzy Rudowski]

(In reply to Kathleen Wilson from comment #6)
> Thank you for the update and for the translated documents.
> 
> Please comment in this bug when OCSP and the BR audit statement are
> available.

Thank you for your comment. I think we'll be ready not earlier than by the end of this year.

Comment 8

[Francis Lee [:frlee]]

There's no update from CA for more than 1.5 year. Closing this bug for now as Won't fix.
if CA ever provides further information, this bug will be re-opened.

Comment 9

[Przemysław Cabaj]

Hello,

I would like to continue Jerzy topic and re-open this bug. 
We still want that our Certificate should be recognized as trusted. Please, include Signet root certificate into Mozilla products.

I’m sending you links for current Standard and SSL baseline audits for Signet Root CA.

Standard:
https://cert.webtrust.org/SealFile?seal=2236&file=pdf
SSL baseline:
https://cert.webtrust.org/SealFile?seal=2238&file=pdf

Please, take a look on this and give me a feedback is is sufficient.

Comment 10

[Przemysław Cabaj]

(In reply to Francis Lee [:frlee] from comment #8)
> There's no update from CA for more than 1.5 year. Closing this bug for now
> as Won't fix.
> if CA ever provides further information, this bug will be re-opened.

Please, re-open bug.

Comment 11

[Kathleen Wilson]

Re-opening this bug, as requested by the CA.

Comment 12

[Kathleen Wilson]

Przemysław, 

Please clarify which root certificates you are requesting inclusion for at this time, and which trust bits (Websites and/or Email) you are requesting for each root cert.

If requesting the Websites trust bit, then please perform the BR Self Assessment, and attach the resulting BR-self-assessment document to this bug.

https://wiki.mozilla.org/CA/BR_Self-Assessment

Comment 13

[Przemysław Cabaj]

(In reply to Kathleen Wilson from comment #12)
> Przemysław, 
> 
> Please clarify which root certificates you are requesting inclusion for at
> this time, and which trust bits (Websites and/or Email) you are requesting
> for each root cert.
> 
> If requesting the Websites trust bit, then please perform the BR Self
> Assessment, and attach the resulting BR-self-assessment document to this bug.
> 
> https://wiki.mozilla.org/CA/BR_Self-Assessment

Dear Kathleen,

Both links are related with CA Signet Certificat Webtrust and SSL Baseline is strictly connected with Websites, so we just requesting trust bits for Websites.

I was trying to complete a BR Self Assesment but I can't open Template for BR Self-Assessment from link https://wiki.mozilla.org/CA/BR_Self-Assessment.

Can you help me wtih this issue? Maybe there is another way to get Template?

Comment 14

[Kathleen Wilson]

(In reply to Przemysław Cabaj from comment #13)
> I was trying to complete a BR Self Assesment but I can't open Template for
> BR Self-Assessment from link https://wiki.mozilla.org/CA/BR_Self-Assessment.
> 
> Can you help me wtih this issue? Maybe there is another way to get Template?


Are you able to open it in Google Docs by clicking on the "Template for BR Self-Assessment" link in the wiki page?

If yes, then within the Google Doc, click on File-> Download as -> Microsoft Excel

Comment 15

[Przemysław Cabaj]

Attachment: Template- CA's BR Self Assessment.xlsx

Dear Kathleen,

I'm attaching the result of BR-self-assessment document to this bug as a next step in  CA Certificate Root Program.

Comment 16

[Aaron Wu]

Hi,

Thanks to provide BR Self Assessment!

Could I know CPS v1.3 is the up-to-date version? it shows "Under approval" in CPS for v1.3, please confirm and provide updated one, and also indicate the release date of this document, thank you!

Best Regards,
Aaron

Comment 17

[Firefox Bug Husbandry Bot]

Bulk reassign, see https://bugzilla.mozilla.org/show_bug.cgi?id=1430324

Comment 18

[Kathleen Wilson]

Attachment: 1024418-CA-Information-April-10-2018.pdf

The attached document shows the information that has been verified, and where further information is needed (search for 'NEED').

Note to the CA: If you are watching the discussions in the mozilla.dev.security.policy forum, you may have noticed that Mozilla has begun rejecting requests for inclusion of root certs whose CA Hierarchies have not been BR-compliant and BR-audited from creation. Therefore, please evaluate your root and CA hierarchy to determine if it would be more productive for you to create a new root certificate with a fully-BR-compliant CA hierarchy before continuing with this request.

Comment 19

[Kathleen Wilson]

Closing this request per lack of response to Comment #18.
If the CA chooses to create a new root certificate, they may start a new root inclusion request as described here:
https://wiki.mozilla.org/CA/Application_Instructions#Create_Root_Inclusion.2FUpdate_Request