274723 - Add XRamp CA Certificate to NSS

Status: VERIFIED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[Frank Hecker]

Per my comments in bug 273189 I've approved this request for XRamp's root CA
certificate to be added to Mozilla et.al. I'll call XRamp to very the
fingerprint on the one root CA cert to be added. For the cert itself see

  http://www.xrampsecurity.com/legal/XGCA.crt

(Nelson, please tell me if you're not the right assignee for this.)

Comment 1

[Frank Hecker]

I've called Scott Harris of XRamp (number obtained from directory assistance)
and verified the SHA-1 fingerprint of the XRamp Root CA certificate to be as
follows:

  B8 01 86 D1 EB 9C 86 A5 41 04 CF 30 54 F3 4C 52 B7 E5 58 C6

I also sent a signed email to Nelson Bolyard regarding this.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Uh, Frank, I'm getting dns lookup failures on www.xrampsecurity.com
Seems this domain is served by ns1.fatdns.com, which is not answering.
what's up with that?  
Can't add this cert if it isn't available!  Is this CA still around?

Comment 3

[Frank Hecker]

XRamp was issuing press releases less than a month ago, so I'd be surprised if
they're out of business. If the domain isn't reachable by Monday I'd call their
phone number and see what's going on. According to a yellow pages lookup they're
located at:

Xramp Technologies Inc
9086 Vista Verde
San Antonio, TX 78255
[phone]

(IIRC this is the number I used when I called to verify their cert fingerprint.)
Ask for Scott Harris.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Last night I learned that fatdns.com is also run by XRamp at the same 
address in San Antonio.  So I called XRamp and also their upstream ISP,
and this morning it was all working again.
www.xrampsecurity.com [65.16.166.67]
I will attach a newer patch to bug 275576, including this CA cert.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Giving this bug back to Wan-Teh.
Perhaps we should separate this into two bugs, with a separate
one for the "qualified" cert, so that this bug can be resolved 
to reflect the fact that most of the XRamp certs have been added.

Comment 6

[Wan-Teh Chang]

Nelson,

In bug 273189, XRamp only requested that a single root
CA cert, XRamp Global Certification Authority, be added.
Since you've already added that root CA, I'm marking this
bug fixed and removing its dependency on bug 277797.

Comment 7

[Wan-Teh Chang]

Verified with NSS 3.10 Beta 3 that XRamp Global Certification Authority
is in the "Builtin Object Token" with the following trust settings:
This certificate can identify web sites.
This certificate can identify mail users.
This certificate can identify software makers.

Mozilla/Firefox trunk nightly builds on 2005-04-13 or later will
have this root CA cert.  The upcoming milestone releases are Mozilla
1.8 Beta 2 and Firefox/Thunderbird 1.1 Alpha.