1727941 - Add Certainly R1 and E1 Root Certificates

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task, P2)

Description

[Wayne Thayer]

Certainly would like to request the inclusion of our RSA (R1) and ECDSA (E1) root certificates.

These roots will only issue TLS server and client authentication certificates.

CCADB Case: https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00000829

The CA certificates, CP/CPS, and other policy documents may be found at https://certainly.com/repository/

The following audit reports are attached to this bug: Root Key Generation Ceremony, Key Protection period, and WTCA and WTBR point-in-time.

Comment 1

[Wayne Thayer]

Attachment: Certainly - 2021 Root Key Generation - Report.pdf

Comment 2

[Wayne Thayer]

Attachment: Certainly)- 2021 WebTrust for CAs (Key Lifecycle Management Activities) - Report.pdf

Comment 3

[Wayne Thayer]

Attachment: Certainly - 2021 WebTrust for CAs - Report.pdf

Comment 4

[Wayne Thayer]

Attachment: Certainly - 2021 WebTrust for CAs (SSL Baseline) - Report.pdf

Comment 5

[Wayne Thayer]

Attachment: Certainly - 8-25-2021 BR Self Assessment.pdf

Comment 6

[Wayne Thayer]

Ben, ALV is failing because (1) the reports are point-in-time, and (2) they are not hosted on the Auditor's website. Are these acceptable errors, or do I need to do something to correct them?

Comment 7

[Ben Wilson]

I wouldn't worry because those are acceptable errors given the current state of your audits, inclusion application, and the processing capabilities of the ALV system.

Comment 8

[Wayne Thayer]

Version 1.3 of the Certainly CP/CPS has been published to https://certainly.com/repository/

Comment 9

[Wayne Thayer]

Attachment: Certainly - 3-9-2022 CA Compliance Self Assessment.pdf

Attaching an updated self-assessment based on Mozilla's new template and CP/CPS version 1.3.

Comment 10

[Wayne Thayer]

Attachment: Certainly - Value to Mozilla.pdf

Attaching Certainly's value statement (https://wiki.mozilla.org/CA/Quantifying_Value).

Comment 11

[Ben Wilson]

Attachment: Root Program Review of 1st CA Compliance Self Assessment.xlsx

This review was conducted on 4-Mar-2022 based on an earlier CA Compliance Self Assessment.

Comment 12

[Ben Wilson]

Public discussion started today 4-4-2022 with closing of public discussion anticipated for 25-Apr-2022 - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/EhXhiHfWGC8/m/58CH8CMwBgAJ

Comment 13

[Ben Wilson]

Public discussion closed today with a recommendation that Certainly's request be approved - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/EhXhiHfWGC8/m/3PcJHizqAAAJ

Comment 14

[Ben Wilson]

The 7-day last-call period has now passed without comment.

Comment 15

[Kathleen Wilson]

As per Comment #14, and on behalf of Mozilla I approve this request from Certainly LLC to include the following root certificates:

** Certainly Root R1 (Websites)
** Certainly Root E1 (Websites)

I will file the NSS bug for the approved changes.

Comment 16

[Kathleen Wilson]

I have filed bug #1768970 against NSS for the actual changes.