1515457 - Add eMudhra Technologies Limited root certificates to NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, enhancement)

Description

[Kathleen Wilson]

This bug requests inclusion in the NSS root store of the following root certificates owned by eMudhra Technologies Limited.

Friendly Name: emSign Root CA - G1
Cert Location: https://repository.emsign.com/certs/emSignRootCAG1.crt
SHA-256 Fingerprint: 40F6AF0346A99AA1CD1D555A4E9CCE62C7F9634603EE406615833DC8C8D00367
Trust Flags: Email; Websites
Test URL: https://testevg1.emSign.com
	 
Friendly Name: emSign ECC Root CA - G3
Cert Location: https://repository.emsign.com/certs/emSignECCRootCAG3.crt
SHA-256 Fingerprint: 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B
Trust Flags: Email; Websites
Test URL: https://testevg3.emsign.com
	 
Friendly Name: emSign Root CA - C1
Cert Location: https://repository.emsign.com/certs/emSignRootCAC1.crt
SHA-256 Fingerprint: 125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F
Trust Flags: Email; Websites
Test URL: https://testevc1.emsign.com
 
Friendly Name: emSign ECC Root CA - C3
Cert Location: https://repository.emsign.com/certs/emSignECCRootCAC3.crt
SHA-256 Fingerprint: BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3
Trust Flags: Email; Websites
Test URL: https://testevc3.emsign.com

This CA has been assessed in accordance with the Mozilla project guidelines, and the certificates approved for inclusion in bug #1442337

The next steps are as follows:
1) A representative of the CA must confirm that all the data in this bug is correct, and that the correct certificates have been attached.
2) A Mozilla representative creates a patch with the new certificates, and provides a special test version of Firefox.
3) A representative of the CA uses the test version of Firefox to confirm (by adding a comment in this bug) that the certificates have been correctly imported and that websites work correctly.
4) The Mozilla representative requests that another Mozilla representative review the patch.
5) The Mozilla representative adds (commits) the patch to NSS, then closes this bug as RESOLVED FIXED.
6) At some time after that, various Mozilla products will move to using a version of NSS which contains the certificates. This process is mostly under the control of the release drivers for those products.

Comment 1

[Kathleen Wilson]

Attachment: emSignRootCA-G1.crt

Comment 2

[Kathleen Wilson]

Attachment: emSignECCRootCA-G3.crt

Comment 3

[Kathleen Wilson]

Attachment: emSignRootCA-C1.crt

Comment 4

[Kathleen Wilson]

Attachment: emSignECCRootCA-C3.crt

Comment 5

[Kathleen Wilson]

Vijay, Please see step #1 above.

Comment 6

[Vijay Kumar]

(In reply to Kathleen Wilson from comment #5)
> Vijay, Please see step #1 above.

I have reviewed this information, and the data in this bug are correct (including the certificates attached). Thank you.

Comment 7

[Kathleen Wilson]

Thanks for confirming that the information in this bug is correct.

Root inclusions are usually grouped and done as a batch when there is either a large enough set of changes or about every 3 months. When the changes are made, a test build will be provided and this bug will be updated to request that you test it. Since you are cc'd on this bug, you will get notification via email when that happens.

Comment 8

[Kathleen Wilson]

Vijay,These root certs have been added to Firefox Nightly, which you can test as described here:
https://wiki.mozilla.org/CA/Application_Instructions#Test
Except that rather than using a test build as described in step #1, use Firefox Nightly:
https://www.mozilla.org/en-US/firefox/channel/desktop/#nightly

Comment 9

[Vijay Kumar]

Thanks Kathleen.

Success:
We are able to verify this by installing the latest nightly build. Verified the presence in Options > Privacy & Security > Certificates > View Certificates. And also verified with the test URLS and getting the successful trust. Verified the trust bits for both web & email.

Doubt:
However, when we visit EV test website, it is not 'displaying the name of the certificate holder'. (Eg: https://testevg1.emsign.com/RootEVG1.html)

Please let me know.

Comment 10

[Kathleen Wilson]

(In reply to Vijay Kumar from comment #9)

Thanks Kathleen.

Success:
We are able to verify this by installing the latest nightly build. Verified the presence in Options > Privacy & Security > Certificates > View Certificates. And also verified with the test URLS and getting the successful trust. Verified the trust bits for both web & email.

Thanks!

Doubt:
However, when we visit EV test website, it is not 'displaying the name of the certificate holder'. (Eg: https://testevg1.emsign.com/RootEVG1.html)

EV treatment gets enabled via a separate bug (Bug #1515465) after the root has been included in NSS.

Comment 11

[Vijay Kumar]

(In reply to Kathleen Wilson from comment #10)

EV treatment gets enabled via a separate bug (Bug #1515465) after the root has been included in NSS.

Thanks Kathleen. That clarifies.