1335253 - Add "Belgium Root CA*" certificates to OneCRL -- March 1, 2017

Status: RESOLVED WONTFIX

(CA Program :: CA Certificate Root Program, task)

Description

[Kathleen Wilson]

The CA Owner (DigiCert), has requested that we add the following Intermediate Certificates to OneCRL after March 1, 2017. These are not yet actually revoked, but these should not be trusted for TLS/SSL so should be added to OneCRL.

Certificate Subject Common Name: Belgium Root CA2
Certificate Issuer Common Name: Cybertrust Global Root
Certificate Serial Number: 04000000000141a1e134ba
-----BEGIN CERTIFICATE-----
MIID7jCCAtagAwIBAgILBAAAAAABQaHhNLowDQYJKoZIhvcNAQEFBQAwOzEYMBYG
A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh
bCBSb290MB4XDTEzMTAxMDExMDAwMFoXDTI1MDUxMjIyNTkwMFowKDELMAkGA1UE
BhMCQkUxGTAXBgNVBAMTEEJlbGdpdW0gUm9vdCBDQTIwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQDGc0Iekv91D4u/dIanP+2yGC0tl/mp+5hKI9/VjeCM
xjIcFi0HQtYttm4vp/X8xoWCXZXetSIAzKhTQJ+vCjWiesfhyvdgEGcOp1BzF1OV
nyKfDF1vtkG8jOvaHUa9p5S/8xrL1PuNDh4zyJbX7IxT3pMeNB6KUHEmWLRdwoiJ
2mDSiSE/3tcBGDZu4SxwAwRl75gGK10eYtxVa/5mZCFf+C/h15spr2/Nn6oMRtGI
xZ2ilZ+sPxWu8mHf78NrmiLYLHH9WB3sAKQ4IJVax9U3Y7pPm6r+VkYuY9kLI9WK
+rUj8IkboRQNJtpB8DiPMO0FJnnBS06huH5VUjppRoR1AgMBAAGjggEEMIIBADAO
BgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATBQBgNVHSAESTBHMEUG
CisGAQQBsT4BZAEwNzA1BggrBgEFBQcCARYpaHR0cDovL2N5YmVydHJ1c3Qub21u
aXJvb3QuY29tL3JlcG9zaXRvcnkwHQYDVR0OBBYEFIWK6/TFu74OWQOU3taAARXj
EJw5MDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly9jcmwub21uaXJvb3QuY29tL2N0
Z2xvYmFsLmNybDARBglghkgBhvhCAQEEBAMCAAcwHwYDVR0jBBgwFoAUtgh7DXrM
rCBMhlYyXs+rboUtcFcwDQYJKoZIhvcNAQEFBQADggEBALLLOUcpFHXrT8gK9htq
XI8dV3LlSAooOqLkn+yRRxt/zS9Y0X0opocf56Kjdu+c2dgw6Ph3xE/ytMT5cu/6
0jT17BTk2MFkQhoAJbM/KIGmvu4ISDGdeobiBtSeiyzRb9JR6JSuuM3LvQp1n0fh
sA5HlibT5rFrKi7Oi1luDbc4eAp09nPhAdcgUkRU9o/aAJLAJho3Zu9uSbw5yHW3
PRGnmfSO67mwsnSDVswudPrZEkCnSHq/jwOBXAWCYVu5bru3rCdojd5qCTn/Wyqb
ZdsgLAPR5Vmf/uG3d5HxTO1LLX1Zyp9iANuG32+nFusi89shA1GPDKWacEm0ASd8
iaU=
-----END CERTIFICATE-----

Certificate Subject Common Name: Belgium Root CA3
Certificate Issuer Common Name: Cybertrust Global Root
Certificate Serial Number: 04000000000141a1e1393e
-----BEGIN CERTIFICATE-----
MIIE7jCCA9agAwIBAgILBAAAAAABQaHhOT4wDQYJKoZIhvcNAQEFBQAwOzEYMBYG
A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh
bCBSb290MB4XDTEzMTAxMDExMDAwMFoXDTI1MDUxMjIyNTkwMFowKDELMAkGA1UE
BhMCQkUxGTAXBgNVBAMTEEJlbGdpdW0gUm9vdCBDQTMwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCo8gGdi4PJB6CF+yS3NwXmdU88vTBL+wZ6+fcXCXs3
P8SSXTuFd28DJbShXzb6rEOR/xkAAxSdBpkyyzwyOQKHlIwbm0WfYcK7lLkNdfr4
baFYbhLmVMaHxCFNsibYkjjjcKaPxiG/QuGGeYfu5bQ6QtzL7BcsqK3ac4MKkh7x
cEwppbOUqVNOVGxe2VT3H1X9uAOSIBy6WU4EHwL58z5ZvvniWPrDaDc0waHuomaY
Zj28bjzXCerJVfKjEEJOdP4PipqD6R1+AL6E6+P+0zE77ivI0tXRJ/n3VSncfaqP
WWURxVv01xJ+UqzVLvfcYc5RP1gbq61cBaCglgo5jtAp3pCZcNDU69xwUxuQ+AIg
4zRVGGiHBiZP4Wva8x82PlqRnaBWcYWz/N2RnqKpIAa/FM3zhQmPHMlDdnW+oaSG
iujbqIaOkFp5/k0jYeR47ouZoqqRsUu94GJU9kMMNeofIBUyUOPX4kvkB5cEcOXK
hbqnxSxN5xRRfSiGpkuE0nu0+HTRmNlWx86WhlU+MMvn5e4FrH2lJL4TOG9NA84A
4ifQR4isrTS5s6Gt0p3oo/wirq9HSeTnTIgKlKUndDnvKXSG5kJtaD+XI3JIkI8c
e/r0sVrWnKRqMFivPu6BLGHPu3y7dxg+qvzuV4uOND3f7BSZn6kX9wtTzzHQal3M
IwIDAQABo4IBBDCCAQAwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
AQEwUAYDVR0gBEkwRzBFBgorBgEEAbE+AWQBMDcwNQYIKwYBBQUHAgEWKWh0dHA6
Ly9jeWJlcnRydXN0Lm9tbmlyb290LmNvbS9yZXBvc2l0b3J5MB0GA1UdDgQWBBS4
vGwAj1sZhZ0lAZzwGdxAjtA4KzA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vY3Js
Lm9tbmlyb290LmNvbS9jdGdsb2JhbC5jcmwwEQYJYIZIAYb4QgEBBAQDAgAHMB8G
A1UdIwQYMBaAFLYIew16zKwgTIZWMl7Pq26FLXBXMA0GCSqGSIb3DQEBBQUAA4IB
AQBCKqC7Pj/nx+UZ10vVjtQmnOX0BwE7Pfe/ZO6sIso7wLh8voX0U6FA7S0FYdk6
3fCZplhYTIznAGyD49Z2M1kIXiCKeqHvXYiy/NuLXGm5L+DGttLDuWV13OF1v7SN
LN1RivjE3FsiJvShROfUdQnh1m/a7wujXfiQTCvWsQCaUXn75LUA5lWn8GtwP4iH
Q+rxhmVCVV/9rMucsVLOSy04B4ho3XoMKLiYFyZ8wimiAi94AqrEQZcl+ZVAGfzc
R+sivhhfT9b/zW2Pf/20iHmaTR+7aUewTn1LdZH3KiB3SzkxFjaDLTIIH6m/7Fhb
Eci/Ho1wNBLdJ1Jeyf+FQdje
-----END CERTIFICATE-----

Certificate Subject Common Name: Belgium Root CA4
Certificate Issuer Common Name: Cybertrust Global Root
Certificate Serial Number: 04000000000141a1e13d26
-----BEGIN CERTIFICATE-----
MIIE7jCCA9agAwIBAgILBAAAAAABQaHhPSYwDQYJKoZIhvcNAQELBQAwOzEYMBYG
A1UEChMPQ3liZXJ0cnVzdCwgSW5jMR8wHQYDVQQDExZDeWJlcnRydXN0IEdsb2Jh
bCBSb290MB4XDTEzMTAxMDExMDAwMFoXDTI1MDUxMjIyNTkwMFowKDELMAkGA1UE
BhMCQkUxGTAXBgNVBAMTEEJlbGdpdW0gUm9vdCBDQTQwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCYkK76xx5vjuAFOrMjeEzR1i/ddTxbGOhPXrsFZpeT
QFk3cPadpnJhDmBseNuIxS6UkFTcccaIdy7CKXVlDEUH7og6s72cf+HQgWnii/wD
ESbi9XesFO91ykpHQ6+bh+h9mH9fc0olDptseJN2jS8k/la8hddW9T66euwgZOtz
gZhtFlGgfhMbQRzpHz2h0RxQNODIoKFRbd4C0ERodVfh9a5tYcnU83es86aCR6d7
o1g+K+JCwq8VRVdEGeOLrLwD5YSqHnBdH3oirXoEtaUvhYxhwPUvOcsWZJxFfDem
2yuWD+5IDSwwwjRSehuzDKX/DBMoF1jG/lq8p03rVpyFeo082QNUZmmbqpiDA71k
wOyTZIgyUDiQVkNxIaflZ+5YtTAiI15RA2CdsEZnEWUNG7FM2jP1d6fkPo/Et6LJ
mtz3OvnQ88S/joP5Z0Zy5Q2qV8dvFwfbq1EeR9Nzs5u+wff5mICHjPGNV57ZQghC
wXriXhGCVKnNBbBsVjcI7AbUaGeHb2ta785F5oybjSEeGCC4PBuJCi4a/SQ67cgp
LyPV5vBg46kCCdiqUIiRwSyQNICsZWHpvAkjv2p9wDsakzWY1m0MehN9jjwf67FN
vJXWnYvXPMnkcly1qVBeBoY8qHODnawJF5pY55MyzAuOfcRi/II+i8jW+lM19HmA
PQIDAQABo4IBBDCCAQAwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
AQEwUAYDVR0gBEkwRzBFBgorBgEEAbE+AWQBMDcwNQYIKwYBBQUHAgEWKWh0dHA6
Ly9jeWJlcnRydXN0Lm9tbmlyb290LmNvbS9yZXBvc2l0b3J5MB0GA1UdDgQWBBRn
6PFOT7O18wdvCJwMg9l62VvnSTA1BgNVHR8ELjAsMCqgKKAmhiRodHRwOi8vY3Js
Lm9tbmlyb290LmNvbS9jdGdsb2JhbC5jcmwwEQYJYIZIAYb4QgEBBAQDAgAHMB8G
A1UdIwQYMBaAFLYIew16zKwgTIZWMl7Pq26FLXBXMA0GCSqGSIb3DQEBCwUAA4IB
AQBcwXlO+W1txa4MNqD0Tq5ofwESbZ0Rrxoh0RYNqXafZR7Yjj6sEKSSz/WgN8CQ
YzEWPB6BaScM+VYgOFq9lqr5aedzcsjStqq5uAUXlgnpWXLVBsvKLKR9cKLXE6i7
T+juFaKYSO0fNGtPm6KJ/7qvNO3KhocJiDjhykUxV92UDgNXMMH2FhBM/7+k14Ug
IEllq8zds225jqz9fuS8Srv2lutEv2BLsG6V4GmU9yz2nuLt8X3McwPhh6X5Ae0P
d1gvofOQF+qDtuR4d3NuUt/dHXLPzQfd0t4gMRIM/09GE+dNzRB8p1YRaT4zHRlh
H+CHDGjHMIBbb69s9wcD+s/t
-----END CERTIFICATE-----

Comment 1

[Kathleen Wilson]

Jeremy, Please confirm that the data in this bug is correct.

Comment 2

[Jeremy Rowley]

Hi Kathleen, 

The request was prior to Verizon receiving a point in time audit that covers all of their intermediates. Now that they have a point in time audit and are working on the full audit. My understanding was that if they got a point in time audit (which they did) then they would have 90 days for a full audit (which they are working on). I'm waiting for confirmation from the Belgium government that they need these roots to work in Mozilla. I'll post here their response. 

Jeremy

Comment 3

[Kathleen Wilson]

(In reply to Jeremy from comment #2)
> Hi Kathleen, 
> 
> The request was prior to Verizon receiving a point in time audit that covers
> all of their intermediates. Now that they have a point in time audit and are
> working on the full audit. My understanding was that if they got a point in
> time audit (which they did) then they would have 90 days for a full audit
> (which they are working on). I'm waiting for confirmation from the Belgium
> government that they need these roots to work in Mozilla. I'll post here
> their response. 
> 
> Jeremy

Any update?

Comment 4

[Jeremy Rowley]

Yes - their full audit is currently under-way. I should have a full audit report shortly.

Comment 5

[Kathleen Wilson]

Audits have been completed for these CA hierarchies, and the CA is working on getting a publishable report and updating the CCADB. So closing this particular bug as wontfix.