1695486 - Add HARICA 2021 SMIME Root CA Certificates to Mozilla Root store program

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task, P1)

Description

[Dimitris Zacharopoulos]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0

Comment 1

[Dimitris Zacharopoulos]

HARICA would like to request the addition of two Root CA Certificates to NSS and the Mozilla root store, and enable the Email trust bit. These roots are not intended to be used for TLS Server authentication.

All HARICA SMIME certificates will eventually be migrated to be issued from subCAs chaining to these roots.

We will start working on a new CCADB case to add information about these two root certificates. We expect these new roots to be included in the audit attestation of our current audit cycle ending 2021-03-29.

Comment 2

[Dimitris Zacharopoulos]

Attachment: HARICA's BR Self [e-mail]

Comment 3

[Dimitris Zacharopoulos]

Attachment: test-smime-ecc.p7b

Comment 4

[Dimitris Zacharopoulos]

Attachment: test-smime-rsa.p7b

Comment 5

[Dimitris Zacharopoulos]

Attachment: RKGC 2021 Attestation Letter

The AAL is also available through from our auditor's web site https://www.qmscert.com/share/040321-01-KG-AAL.pdf

Comment 6

[Ben Wilson]

See CPS review here - https://bugzilla.mozilla.org/show_bug.cgi?id=1695487#c6

Comment 7

[Ben Wilson]

Public discussion on this request was announced here - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/UAmBtcVvBKw/m/o5cYt-dFAAAJ. The public discussion period is scheduled to close on 11-June-2021.

Comment 8

[Ben Wilson]

The 3-week public discussion period has now passed and there were no objections to this inclusion request. See https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/UAmBtcVvBKw/m/5nZlAMk7BAAJ in which I indicated that it is Mozilla’s intent to approve HARICA’s requests for EV enablement/inclusion and started the 7-day “last call” period (through June 22, 2021) for any final objections.

Comment 9

[Kathleen Wilson]

As per Comment #8, and on behalf of Mozilla I approve this request from HARICA to include the following root certificates:

** HARICA Client RSA Root CA 2021 (Email)
** HARICA Client ECC Root CA 2021 (Email)

I will file the NSS bug for the approved changes.

Comment 10

[Kathleen Wilson]

I have filed bug #1717707 against NSS for the actual changes.