1331364 - Add Root Certification Authority of the Republic of Kazakhstan (root.gov.kz)

Status: RESOLVED WONTFIX

(CA Program :: CA Certificate Root Program, task)

Description

[Assel]

Attachment: PKI_checklist.zip

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36

Steps to reproduce:

Fully completed and approved checklist

Linked bug - 1232689

Survey of introduction of the rootcertificate to known browsers is completed.
https://ru.surveymonkey.net/results/SM-XBQ625SN/
Support - 57,14%, not support - 42,86%

Published post about matters of using registration certificates of the National Certification Authority of the Republic of Kazakhstan
http://mic.gov.kz/en/news/matters-using-registration-certificates-national-certification-authority-republic-kazakhstan




CA Details
----------

CA Name: Republican state enterprise in the right of business «State technical service» of the Committee of Communication, Informatization and Information of the Ministry of Investment and Development of the Republic of Kazakhstan (hereafter - STS).
Website: Public Key Infrastructure (PKI) – http://pki.gov.kz/index.php/en/
One Paragraph Summary of CA, including the following:
 - STS is a non-profit organization managed by Government of the Republic of Kazakhstan which works under Committee of communications, informatization and information of the Ministry of Investment and Development of the Republic of Kazakhstan.
 - PKI serves members of E-government, government and non-government information systems. All services provided by PKI are free of charge for the citizens of the Republic of Kazakhstan.

Audit Type (WebTrust, ETSI etc.): WebTrust
Auditor: plan to be audited in 2016 with WebTrust
Auditor Website: will be provided after successful choice of auditor 
Audit Document URL(s): will be provided after successful choice of auditor

Certificate Details
-------------------
(To be completed once for each certificate; note that we only include root
certificates in the store, not intermediates.)

Certificate Name: НЕГІЗГІ КУӘЛАНДЫРУШЫ ОРТАЛЫҚ (RSA)
Summary Paragraph, including the following:
 - Certificate is needed for creation of a common space of trust between information exchange participants in the Republic of Kazakhstan.(http://root.gov.kz/cps/certificate_policy.pdf)
 - Number and type of subordinate CAs: 3 root 
 - Diagram and/or description of certificate hierarchy: http://root.gov.kz/assets/images/scheme.png

Certificate download URL (on CA website): http://pki.gov.kz/cert/pki_rsa.cer
Version: V3
SHA1 Fingerprint: e0 66 36 22 e5 9c 55 7a 3a 33 21 6b 77 44 76 78 98 5f 2a 72
Public key length (for RSA, modulus length) in bits: 4096 bits
Valid From (YYYY-MM-DD): Monday, ‎July ‎27, ‎2015 11:22:53 AM
Valid To (YYYY-MM-DD): Sunday, ‎July ‎27, ‎2025 11:22:53 AM

CRL HTTP URL:http://crl.root.gov.kz/rsa.crl; http://crl1.root.gov.kz/rsa.crl
OCSP URL:
There is no necessity for certificates checking because all the client certificates that have to be checked are checked by NCA which is a subordinate certificate authority of RCA.



Expected results:

Include certificate as trusted in new browser builds of Mozilla

Comment 1

[Assel]

Attachment: 1232689-CAInformation.pdf

Comment 2

[David E. Ross]

Have the issues raised in bug #1229827 and bug #1232689 been resolved?  If so, details of how they were resolved should be provided as comments here, in this bug report.

Comment 3

[Gervase Markham [:gerv]]

In addition, we will be unable to evaluate http://root.gov.kz/cps/certificate_policy.pdf without an English translation.

Gerv

Comment 4

[StudioMaX]

According to what is written in the header of http://root.gov.kz/cps/certificate_policy.pdf, this document was deprecated in favor of these documents:
Certificate Policy English version: http://root.gov.kz/cps/CERTIFICATE_POLICY_KUC2.pdf
Certificate Policy Russian version: http://root.gov.kz/cps/politica_kuc_versiya2.pdf

Comment 6

[Kathleen Wilson]

Closing this bug per Bug #1232689#c14