1734114 - Netlock: Problem with NETLOCK's codesigning CA

Status: RESOLVED INVALID

(CA Program :: CA Certificate Compliance, task)

Description

[Zoltán Kővári-Szabó]

Attachment: Certop_cert_Netlock_with_annex_english_2021_final_sign.pdf

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36

Steps to reproduce:

The latest audit has revealed that NetLock CodeSign CA (C56F0F286618C1E7B0E112C97B9EE96FEB4D71E79496C151FA1FE8A8CEBD06CD) is partially compliant with CSBR 2.3 Annex A. As it can be read in the audit report's annex (section CSBR 2.3), the certificates, which were issued after 1st June 2021, and their corresponding Root Certificate and Intermediate CA Certificate aren’t compliant with all the requirements, the RSA modulus size (bits) is only 2048 bits instead of 3072 bits.

Actual results:

Issuance of code signing certificates has been stopped immediately.
We have made the decision to terminate issuing code signing certificates.

Expected results:

Today a new taskforce (that I mentioned in the ticket #1680378) are going to have a meeting to decide the steps of termination.

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:kwilson, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Zoltán Kővári-Szabó]

Dear Ben,
we kindly inform you that we have terminated code signing business, that means our clients are not able to request issuing or renewing code signing certificates anymore. Do you need any more information on this or do you expect any more measure related to this bug?
By the way I would like to inform you, that my employment in NETLOCK is terminating on 12.11.21. From 12.11.21 you can discuss with Győző Drozdy ([e-mail]) and Anna Bányai ([e-mail]) related to NETLOCK's cases.

Sincerely,
Zoltán

Comment 3

[Ben Wilson]

I am closing this today as invalid because Mozilla no longer deals with the code signing trust bit.