1781510 - Add D-Trust SBR Root CAs 1 & 2 2022

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task, P1)

Description

[Ben Wilson]

D-Trust submitted two roots for inclusion.

D-Trust SBR Root CA 1 2022 - https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00001001
https://crt.sh/?sha256=D92C171F5CF890BA428019292927FE22F3207FD2B54449CB6F675AF4922146E2

D-Trust SBR Root CA 2 2022 - https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00001000
https://crt.sh/?sha256=DBA84DD7EF622D485463A90137EA4D574DF8550928F6AFA03B4D8B1141E636CC

Comment 1

[Enrico Entschew]

Attachment: Audit Attestation for D-TRUST SBR Root CA 1 2022

Comment 2

[Enrico Entschew]

Attachment: Audit Attestation for D-TRUST SBR Root CA 2 2022

https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/en/AA2022081902_D-TRUST_SBR_Root_CA_2_2022_V1.0.pdf

Comment 3

[Enrico Entschew]

Comment on attachment 9291516 [details]
Audit Attestation for D-TRUST SBR Root CA 1 2022

https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2022081901_D-TRUST_SBR_Root_CA_1_2022_V1.0.pdf

Comment 4

[Enrico Entschew]

Attachment: D-Trust SBR Root CA 1 2022.cer

https://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_1_2022.crt

Comment 5

[Enrico Entschew]

Attachment: D-Trust SBR Root CA 2 2022.cer

https://www.d-trust.net/cgi-bin/D-Trust_SBR_Root_CA_2_2022.crt

Comment 6

[Enrico Entschew]

Attachment: PKI Structure Root Inclusion D-Trust SBR Root CA 1 2022 (ECC)

Comment 7

[Enrico Entschew]

Attachment: PKI Structure Root Inclusion D-Trust SBR Root CA 2 2022 (RSA)

Comment 8

[Enrico Entschew]

Dear Ben,
Please find the root CA certificates, the audit attestations and the PKI hierarchy overviews.
In future, the “D-Trust SBR Root CA 1 2022” root CA (ECC) and the “D-Trust SBR Root CA 2 2022” root CA (RSA) are to replace the existing “D-TRUST Root CA 3 2013” root CA.
We are currently carrying out the self-assessment for both root CAs. We will submit the result after completion.
Thanks,
Enrico

Comment 9

[Ben Wilson]

Could you please attach an end-entity SMIME certificate issued under each of these roots to this bug? Also, can you upload information about your key generation, too?
Thanks, Ben

Comment 10

[Enrico Entschew]

Please find here the links of the audit attestations of the key generation:
https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2022081901_D-TRUST_SBR_Root_CA_1_2022_V1.0.pdf
https://www.tuvit.de/fileadmin/Content/TUV_IT/zertifikate/de/AA2022081902_D-TRUST_SBR_Root_CA_2_2022_V1.0.pdf

The end-entity S/MIME certificates issued under each of these roots will be published here as soon as it is available.
Thanks, Enrico

Comment 11

[Ben Wilson]

Thanks, Enrico. That information has been updated in the CCADB. How do you propose that we handle the Self Assessment for these S/MIME Root CAs, since you completed a self assessment within the last few years- e.g. https://bugzilla.mozilla.org/attachment.cgi?id=9246613 ? We have a new form, but it mainly is geared toward SSL/TLS and the Baseline Requirements. It appears that my questions regarding the email trust bit were asked and answered in that attachment you provided in Bugzilla #1679258. We look forward to receiving your S/MIME certificates.

Comment 12

[Ben Wilson]

How soon do you think it will be until you can upload your sample S/MIME certificates here?
Thanks,
Ben

Comment 13

[Enrico Entschew]

Dear Ben,
After checking with the product management, we will provide the certificates by the end of May at the latest.
Thanks,
Enrico

Comment 14

[Enrico Entschew]

Attachment: test certificate from the S/MIME root CA "D-Trust SBR Root CA 2 2022"

Here is the test certificate from the S/MIME root CA "D-Trust SBR Root CA 2 2022". You can also download the certificate here: https://www.d-trust.net/internet/files/RollOverSmime_RSA.cer

Comment 15

[Enrico Entschew]

Attachment: test certificate from the S/MIME root CA "D-Trust SBR Root CA 1 2022"

Here is the test certificate from the S/MIME root CA "D-Trust SBR Root CA 1 2022". You can also download the certificate here: https://www.d-trust.net/internet/files/RollOverSmime_EC.cer

Comment 16

[Ben Wilson]

Public discussion commenced on 2023-11-03 (https://groups.google.com/a/ccadb.org/g/public/c/EPVczE_6oCc/m/s90nO9-EBAAJ) and concluded on 2023-12-15 (https://groups.google.com/a/ccadb.org/g/public/c/EPVczE_6oCc/m/jsZ0CsgdAAAJ). Today I sent notice to the Mozilla Dev-Security-Policy list that I am recommending approval of D-Trust's request. https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vjX1-3zQ7ds/m/mSnRpjgOAAAJ. This starts a 7-day "last call" which will run through December 26, 2023.

Comment 17

[Ben Wilson]

As per Comment #16, and on behalf of Mozilla, this request from D-Trust to include the following root certificates is Approved:

** D-Trust SBR Root CA 1 2022 (Email)
** D-Trust SBR Root CA 2 2022 (Email)

I will file the NSS bug for the approved changes.

Comment 18

[Ben Wilson]

Bug # 1873095 has been created to add these CA certificates to NSS.

Comment 19

[Ben Wilson]

These two roots are in Firefox Nightly 124.0a1 (2024-02-01).