1874017 - Add Telekom Security Roots to NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

This bug requests inclusion in the NSS root store of the following root certificates owned by Deutsche Telekom Security GmbH.

Root Certificate 1 of 4

Friendly Name: Telekom Security SMIME ECC Root 2021
Cert Location: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom_Security_SMIME_ECC_Root_2021.cer
SHA-1 Fingerprint: B7F91D98EC2593F35014849AA87E22103CC43927
SHA-256 Fingerprint: 3AE6DF7E0D637A65A8C81612EC6F9A142F85A16834C10280D88E707028518755
Trust Flags: Email
Test URL: N/A

Root Certificate 2 of 4

Friendly Name: Telekom Security TLS ECC Root 2020
Cert Location: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom_Security_TLS_ECC_Root_2020.cer
SHA-1 Fingerprint: C0F896C5A93B01062107DA184248BCE99D88D5EC
SHA-256 Fingerprint: 578AF4DED0853F4E5998DB4AEAF9CBEA8D945F60B620A38D1A3C13B2BC7BA8E1
Trust Flags: Websites
Test URL: https://active.tstlser20.test.telesec.de/

Root Certificate 3 of 4

Friendly Name: Telekom Security SMIME RSA Root 2023
Cert Location: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom_Security_SMIME_RSA_Root_2023.cer
SHA-1 Fingerprint: 893F6F1CE24D7FFBC3D3147A0580A7DEE10A5E4D
SHA-256 Fingerprint: 78A656344F947E9CC0F734D9053D32F6742086B6B9CD2CAE4FAE1A2E4EFDE048
Trust Flags: Email
Test URL: N/A

Root Certificate 4 of 4

Friendly Name: Telekom Security TLS RSA Root 2023
Cert Location: https://www.telesec.de/assets/downloads/PKI-Repository/Telekom_Security_TLS_RSA_Root_2023.cer
SHA-1 Fingerprint: 54D3ACB3BD5756F6859DCEE5C321E2D4AD83D093
SHA-256 Fingerprint: EFC65CADBB59ADB6EFE84DA22311B35624B71B3B1EA0DA8B6655174EC8978646
Trust Flags: Websites
Test URL: https://active.tstlsrr23.test.telesec.de/

This CA operator has been assessed in accordance with the Mozilla project guidelines, and the certificates approved for inclusion in bug #1820592

The next steps are as follows:

1. A representative of the CA must confirm that all the data in this bug is correct, and that the correct certificates have been attached.
2. A Mozilla representative creates a patch with the new certificates.
3. The Mozilla representative requests that another Mozilla representative review the patch.
4. The Mozilla representative adds (commits) the patch to NSS, then closes this bug as RESOLVED FIXED.
5. At some time after that, various Mozilla products will move to using a version of NSS which contains the certificate. This process is mostly under the control of the release drivers for those products.

Comment 1

[Ben Wilson]

Attachment: Telekom_Security_TLS_RSA_Root_2023.cer

Comment 2

[Ben Wilson]

Attachment: Telekom_Security_SMIME_RSA_Root_2023.cer

Comment 3

[Ben Wilson]

Attachment: Telekom_Security_TLS_ECC_Root_2020.cer

Comment 4

[Ben Wilson]

Attachment: Telekom_Security_SMIME_ECC_Root_2021.cer

Comment 5

[Stefan Kirch]

I confirm that all the data in this bug is correct, and that the correct certificates have been attached.

Comment 6

[John Schanck [:jschanck]]

Attachment: Bug 1874017 - Add Telekom Security roots. r=bwilson

Depends on D200052

Comment 7

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/8059ec72f1a6ad8604cbe15e2f21073bfec5c416