1310580 - Add new KISA Root certificate(KISA RootCA 4) to Trusted Root Store

Status: RESOLVED WONTFIX

(CA Program :: CA Certificate Root Program, task)

Description

[JinwooJung]

User Agent: Mozilla/5.0 (Windows NT 6.1; APCPMS=^N20140115041946137138498B2B92A4C5B53F_1387^; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; Tablet PC 2.0; GWX:DOWNLOADED; GWX:RESERVED; rv:11.0) like Gecko

Steps to reproduce:

As KISA has decided to use this new certificate (KISA RootCA 4) to issue certificates of an Issuing CA which will issue SSL certificates, we would like to add our Root certificate (KISA RootCA 4) to Mozilla Trusted Root Store. 


Actual results:

An warning message occurs when a user visits a website installed with our SSL due to  not trusted Root certificate.  


Expected results:

We would like to expect that the Root certificate (KISA RootCA 4) is included in Mozilla Trusted Root Store.

Comment 1

[Kathleen Wilson]

Please see:

1) https://bugzilla.mozilla.org/show_bug.cgi?id=335197#c168

2) https://wiki.mozilla.org/CA:SubordinateCA_checklist#Super-CAs
"Some CAs sign the certificates of subordinate CAs to show that they have been accredited or licensed by the signing CA. Such signing CAs are called Super-CAs, and their (first-level) subordinate CAs must apply for inclusion of their own certificates until the following has been established and demonstrated: ..."

Comment 2

[JinwooJung]

(In reply to Kathleen Wilson from comment #1)
> Please see:
> 
> 1) https://bugzilla.mozilla.org/show_bug.cgi?id=335197#c168
> 
> 2) https://wiki.mozilla.org/CA:SubordinateCA_checklist#Super-CAs
> "Some CAs sign the certificates of subordinate CAs to show that they have
> been accredited or licensed by the signing CA. Such signing CAs are called
> Super-CAs, and their (first-level) subordinate CAs must apply for inclusion
> of their own certificates until the following has been established and
> demonstrated: ..."

Hello, Kathleen.
We fully understand our Root CA certificate has been categorized as Super-CA. Also we would like to include a new Root CA certifcate(KISA RootCA 4) into Mozilla products. In this case, is it correct that Sub-CA(s) under KISA Root CA will apply separately its CA certificate linked to KISA RootCA 4 to Mozilla?

Comment 3

[Kathleen Wilson]

Will the new root CA certificate (KISA RootCA 4) also sign the subCAs that are currently signed by the old KISA root certificate?

Comment 4

[JinwooJung]

(In reply to Kathleen Wilson from comment #3)
> Will the new root CA certificate (KISA RootCA 4) also sign the subCAs that
> are currently signed by the old KISA root certificate?

Subjects are same. The SubCAs are currently signed by KISA RootCA1 and RootCA4.

Comment 5

[Firefox Bug Husbandry Bot]

Bulk reassign, see https://bugzilla.mozilla.org/show_bug.cgi?id=1430324

Comment 6

[Kathleen Wilson]

In bug #335197 it was determined that KISA would need to apply to have its subCAs directly included as trust anchors.

Therefore, I think this request is for the inclusion of the KISA RootCA1 and RootCA4 certs as trust anchors. 

For each subCA to be directly considered for inclusion, the CA needs to update this bug to provide the information listed at the following wiki page.

https://wiki.mozilla.org/CA/Information_Checklist

Comment 7

[Kathleen Wilson]

Concerns about auditor: Bug #1451235

Request for inclusion of a subCA of another KISA root: Bug #1377389

Comment 8

[Jinseo Kim]

There's a concern about KISA itself:

KISA is a public institution and is controlled by the Korean government.
The problem here is that the South Korean government is actively pursuing censorship and concerns that they can legally attempt an MITM attack.

In accordance with Article 44.7.3. of the Act on Promotion of Information and Communication Network Utilization and Information Protection in Korea, the South Korean government may order Internet service providers to block 'hazardous sites'.

Recently, under the leadership of the South Korean government, Internet service providers operate a system to drop packets through the HTTPS protocol through SNI eavesdropping.

I am seriously concerned about the more serious censorship structure that could be formed when this Root CA is registered and I ask KISA to confirm that it will never cooperate with the South Korean government's attempt to attack MITM.

Comment 9

[Ben Wilson]

I intend to close this inclusion request bug on or about 1-September-2020 because it does not appear to be actively pursued.