1782092 - Add Atos Roots

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task, P1)

Description

[Ben Wilson]

Atos has several new roots that it is requesting be added. See https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00000999

Comment 1

[Ben Wilson]

Atos needs to complete all of the "NEED" fields in the CCADB and also a Compliance Self-Assessment (https://wiki.mozilla.org/CA/Compliance_Self-Assessment) and upload it to this Bugzilla bug.

Comment 2

[matthias.wessels]

Attachment: Atos_ CA Compliance Self Assessment.xlsx

Comment 3

[matthias.wessels]

Attachment: Atos_TrustedRoot_CPS_IssuingCAs_v2.7.2.pdf

Comment 4

[matthias.wessels]

Attachment: Atos_TrustedRoot_CPS_RootCA_v2.7.2.pdf

Comment 5

[Michael Risthaus]

Attachment: ECC_sample_smime.pem

Sample SMIME certificate using ECC

Comment 6

[Michael Risthaus]

Attachment: RSA_sample_smime.pem

Sample SMIME certificate using RSA4096

Comment 7

[Ben Wilson]

Attachment: Auditor-witnessed Key Generation - SECP384 CA_2020_3 (ECC TLS 2021).pdf

Key generation witnessed by Klaus-Werner Schröder from datenschutzCert GmbH

Comment 8

[Ben Wilson]

Attachment: Auditor-witnessed Key Generation - SECP384 CA_2020_2 (ECC G2 2020).pdf

Key generation witnessed by Klaus-Werner Schröder from datenschutzCert GmbH

Comment 9

[Ben Wilson]

Attachment: Auditor-witnessed Key Generation – ATC_TR_ROOT_4096_RSA_CA_2020_3 (RSA TLS2021 ).pdf

Key generation witnessed by Klaus-Werner Schröder from datenschutzCert GmbH

Comment 10

[Ben Wilson]

Attachment: Auditor-witnessed Key Generation - ATC_TR_ROOT_4096_RSA_CA_2020_2 (RSA G2 2020).pdf

Key generation witnessed by Klaus-Werner Schröder from datenschutzCert GmbH

Comment 11

[Ben Wilson]

Attachment: 20201207_Report_KeyGen.pdf

Comment 12

[matthias.wessels]

Attachment: 20201207_Report_KeyGen_en.pdf

English language version of KEY GEN Audit Report

Comment 13

[Ben Wilson]

CA application is in public discussion until March 20, 2023 - https://groups.google.com/a/ccadb.org/g/public/c/v5yFBHjuBRo/m/YT_SjO2_BQAJ

Comment 14

[Ben Wilson]

Attachment: Atos-CA-Compliance-Self-Assessment-Reviewed-by-Mozilla.xlsx

Comment 15

[matthias.wessels]

Hello Ben,
many thanks for the file.
We will start processing as soon as possible and then give you a hint after completion
br, Matthias

Comment 16

[matthias.wessels]

Hello Ben,
based on your remarks we have updated our CP/CPS to Version 2.7.3.
you could find new on https://pki.atos.net/trustcenter/de/download/trusted-root-ca
br, Matthias

Comment 17

[Ben Wilson]

I am recommending that we approve the inclusion of the following four (4) ATOS Trustcenter root CA certificates:

Atos TrustedRoot Root CA RSA G2 2020 - https://crt.sh/?sha256=78833A783BB2986C254B9370D3C20E5EBA8FA7840CBF63FE17297A0B0119685E
Atos TrustedRoot Root CA RSA TLS 2021 - https://crt.sh/?sha256=81A9088EA59FB364C548A6F85559099B6F0405EFBF18E5324EC9F457BA00112F
Atos TrustedRoot Root CA ECC G2 2020 - https://crt.sh/?sha256=E38655F4B0190C84D3B3893D840A687E190A256D98052F159E6D4A39F589A6EB
Atos TrustedRoot Root CA ECC TLS 2021 - https://crt.sh/?sha256=B2FAE53E14CCD7AB9212064701AE279C1D8988FACB775FA8A008914E663988A8

See https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/39IywQ_olik/m/9RJSd0u-AAAJ

Comment 18

[Kathleen Wilson]

As per Comment #17, and on behalf of Mozilla I approve this request from Atos Trustcenter to include the following root certificates:

** Atos TrustedRoot Root CA RSA G2 2020 (Email)
** Atos TrustedRoot Root CA ECC G2 2020 (Email)
** Atos TrustedRoot Root CA RSA TLS 2021 (Websites)
** Atos TrustedRoot Root CA ECC TLS 2021 (Websites)

I will file the NSS bug for the approved changes.

Comment 19

[Kathleen Wilson]

I have filed bug #1833270 against NSS for the actual changes.