1840429 - Add Sectigo E46 and R46 Root CA certificates to NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Kathleen Wilson]

This bug requests inclusion in the NSS root store of the following root certificates owned by Sectigo.

Friendly Name: Sectigo Public Email Protection Root E46
Cert Location: https://secure.sectigo.com/products/download/cacert/SectigoPublicEmailProtectionRootE46.crt
SHA-1 Fingerprint: 3AC5C378345BE1829246ED1786B393917B51F214
SHA-256 Fingerprint: 22D9599234D60F1D4BC7C7E96F43FA555B07301FD475175089DAFB8C25E477B3
Trust Flags: Email

Friendly Name: Sectigo Public Email Protection Root R46
Cert Location: https://secure.sectigo.com/products/download/cacert/SectigoPublicEmailProtectionRootR46.crt
SHA-1 Fingerprint: D37B8B0AE84244FB6B8038EEAE9180261A487066
SHA-256 Fingerprint: D5917A7791EB7CF20A2E57EB98284A67B28A57E89182DA53D546678C9FDE2B4F
Trust Flags: Email

Friendly Name: Sectigo Public Server Authentication Root E46
Cert Location: https://secure.sectigo.com/products/download/cacert/SectigoPublicServerAuthenticationRootE46.crt
SHA-1 Fingerprint: EC8A396C40F02EBC4275D49FAB1C1A5B67BED29A
SHA-256 Fingerprint: C90F26F0FB1B4018B22227519B5CA2B53E2CA5B3BE5CF18EFE1BEF47380C5383
Trust Flags: Websites
Test URL: https://sectigopublicserverauthenticationroote46-ev.sectigo.com/

Friendly Name: Sectigo Public Server Authentication Root R46
Cert Location: https://secure.sectigo.com/products/download/cacert/SectigoPublicServerAuthenticationRootR46.crt
SHA-1 Fingerprint: AD98F9F3E47D753B65D482B3A45217BB6EF5E438
SHA-256 Fingerprint: 7BB647A62AEEAC88BF257AA522D01FFEA395E0AB45C73F93F65654EC38F25A06
Trust Flags: Websites
Test URL: https://sectigopublicserverauthenticationrootr46-ev.sectigo.com/

This CA has been assessed in accordance with the Mozilla project guidelines, and the certificates approved for inclusion in bug #1817340

The next steps are as follows:

1. A representative of the CA must confirm that all the data in this bug is correct, and that the correct certificates have been attached.
2. A Mozilla representative creates a patch with the new certificates.
3. The Mozilla representative requests that another Mozilla representative review the patch.
4. The Mozilla representative adds (commits) the patch to NSS, then closes this bug as RESOLVED FIXED.
5. At some time after that, various Mozilla products will move to using a version of NSS which contains the certificates. This process is mostly under the control of the release drivers for those products.

Comment 1

[Kathleen Wilson]

Attachment: SectigoPublicEmailProtectionRootE46.crt

Comment 2

[Kathleen Wilson]

Attachment: SectigoPublicEmailProtectionRootR46.crt

Comment 3

[Kathleen Wilson]

Attachment: SectigoPublicServerAuthenticationRootE46.crt

Comment 4

[Kathleen Wilson]

Attachment: SectigoPublicServerAuthenticationRootR46.crt

Comment 5

[Kathleen Wilson]

Rob, Please see step #1 above.

Comment 6

[Martijn Katerbarg]

Kathleen, with this comment please accept our confirmation that all data in this bug is correct and that the correct certificates have been attached.

Comment 7

[Rob Stradling]

Thanks Martijn.

Comment 8

[John Schanck [:jschanck]]

Attachment: Bug 1840429 - Add Sectigo E46 and R46 Root CA certificates. r=nkulatova

Depends on D183905

Comment 9

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/723c6fadb0800bc529faf89838a6ddf8bf2b30e7