Add Brazil's National PKI (ICP-Brasil) Root Certificates
Categories
(CA Program :: CA Certificate Root Program, enhancement)
Tracking
(Not tracked)
People
(Reporter: diegobiavati, Unassigned)
Details
Attachments
(1 file)
|
343.09 KB,
application/zip
|
Details |
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0
Steps to reproduce
CA Information
CA Name: Instituto Nacional de Tecnologia da Informação (ITI) - ICP-Brasil
Country: Brazil
CA Official Website: https://www.gov.br/iti/
Request Type
This is a formal request to initiate the process for including the Brazilian National PKI (ICP-Brasil) root certificates into the Mozilla Root Store.
Root Certificate Details & Repository
The official, government-hosted repository containing all the active and historical Root Certificates, Certification Policies (CP), Certification Practice Statements (CPS), and CRLs can be verified at:
https://www.gov.br/iti/pt-br/assuntos/repositorio/repositorio-ac-raiz
Active root versions to be considered for WebPKI/SSL and Code Signing trust bits:
- AC Raiz ICP-Brasil v4
- AC Raiz ICP-Brasil v5
- AC Raiz ICP-Brasil v6 / v7
- AC Raiz ICP-Brasil v10 (SSL) / v11 (Code Signing)
- AC Raiz ICP-Brasil v12
- AC Raiz ICP-Brasil v13
Public Value
ICP-Brasil is the root authority that issues digital identities, corporate certificates, and SSL/TLS certificates for the entire Brazilian public administration, banking system, e-commerce, and federal services. Including these roots natively will fix TLS validation errors for millions of users accessing Brazilian governmental and institutional platforms out-of-the-box.
Next Steps
I am filing this initial task to track the inclusion. We welcome Mozilla's CA Program managers to evaluate the repository and request the official ITI representatives to fulfill the required CCADB (Common CA Database) case registration and submit the audit documentation (WebTrust/BR).
Actual results
N/A
Expected results
N/A
This is a third-party request, please see the ongoing discussion where nothing has changed in: #1674669. This certificate issued today says it all: https://crt.sh/?id=29730821063&opt=pkimetal
Description
•