745671 - Enable EV and Turn on Code Signing trust bit for TWCA Root certificate

Status: RESOLVED FIXED

(CA Program :: CA Certificate Root Program, task)

Description

[Robin Lin]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

This request is to EV enable the TWCA Root certificate which has been included in Mozilla NSS.
CA Name: TWCA Root Certification Authority

The WebTrust for CA/EV audit report can be view with following link:
https://cert.webtrust.org/ViewSeal?id=1248
https://cert.webtrust.org/ViewSeal?id=1249

The EV CA CPS can be download using following link:
http://www.twca.com.tw/picture/file/20120102-152000370.pdf

Comment 1

[Robin Lin]

The TWCA EVSSL test web site is:
https://evssldemo.twca.com.tw/index.html	(normal)
https://evssldemo1.twca.com.tw/index.html	(revoked)
https://evssldemo2.twca.com.tw/index.html	(expired)

Comment 2

[Robin Lin]

TWCA also needs to enable S/MIME and object signing trust bit. 
The issuing CA CPS can be download from following link:
http://www.twca.com.tw/picture/file/20110523-180517756.pdf

Comment 3

[Kathleen Wilson]

Accepting this bug, and starting the information verification phase.
https://wiki.mozilla.org/CA:How_to_apply#Information_Verification

Comment 4

[Kathleen Wilson]

(In reply to Robin Lin from comment #2)
> TWCA also needs to enable S/MIME and object signing trust bit. 

The email and websites trust bits are already turned on for this root.

This request is to turn on the code signing trust bit and to enable EV.

Comment 5

[Kathleen Wilson]

Attachment: Initial CA Information Document

The attached document summarizes the information that has been verified.

The items highlighted in yellow indicate where further information or
clarification is needed. Please review the full document for accuracy and
completeness.

Comment 6

[Robin Lin]

Attachment: Update TWCA information gathering document for EV, code signing

Update the required information for CA information gathering.
Please review.

Robin Lin

Comment 7

[Kathleen Wilson]

Thanks for the information.

Please post a comment in this bug when:

1) The IDP extension has been removed from CRL.

2) EV Testing has been completed as per
https://wiki.mozilla.org/PSM:EV_Testing_Easy_Version

Comment 8

[Robin Lin]

(In reply to Kathleen Wilson from comment #7)
> Thanks for the information.
> 
> Please post a comment in this bug when:
> 
> 1) The IDP extension has been removed from CRL.
> 
> 2) EV Testing has been completed as per
> https://wiki.mozilla.org/PSM:EV_Testing_Easy_Version

I am try to test the EV enable but failed.
I create a text file(test_ev_root.txt) with following text:

1_fingerprint cf:9e:87:6d:d3:eb:fc:42:26:97:a3:b5:a3:7a:a0:76:a9:06:23:48
2_readable_oid 2.16.886.3.1.6.5
3_issuer MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jvb3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==
4_serial AQ==

I also set set ENABLE_TEST_EV_ROOTS_FILE=1 before start firefox test version(I test it in Windows 7 OS).
Did I do anything wrong with test_ev_root.txt file?

Comment 9

[Robin Lin]

(In reply to Kathleen Wilson from comment #7)
> Thanks for the information.
> 
> Please post a comment in this bug when:
> 
> 1) The IDP extension has been removed from CRL.
> 
> 2) EV Testing has been completed as per
> https://wiki.mozilla.org/PSM:EV_Testing_Easy_Version

The CRL IDP extension has been removed from EVSSL certificate CRL.
Please verify.

Thanks and Regards,
Robin Lin

Comment 10

[Kathleen Wilson]

Kai, Robin is trying to do the PSM:EV_Testing_Easy_Version for a root certificate that is already included in NSS...
CN = TWCA Root Certification Authority
OU = Root CA
O = TAIWAN-CA
C = TW
SHA1: CF:9E:87:6D:D3:EB:FC:42:26:97:A3:B5:A3:7A:A0:76:A9:06:23:48

Would you please create and attach the test_ev_roots.txt file for this root?

Comment 11

[Kathleen Wilson]

(In reply to Robin Lin from comment #9)
> The CRL IDP extension has been removed from EVSSL certificate CRL.
> Please verify.

Confirmed -- I'm able to import that CRL into my FF browser without error now.

Comment 12

[Kai Engert [:KaiE:]]

The data in comment 8 appears to be correct.

Comment 13

[Kai Engert [:KaiE:]]

Attachment: test_ev_roots

I tested, and I get EV status on site https://evssldemo.twca.com.tw/index.html

Did you place the file into the correct directory? It must be in the same directory as other existing profile files, e.g. prefs.js

Comment 14

[Robin Lin]

(In reply to Kai Engert (:kaie) from comment #13)
> Created attachment 644249 [details]
> test_ev_roots
> 
> I tested, and I get EV status on site
> https://evssldemo.twca.com.tw/index.html
> 
> Did you place the file into the correct directory? It must be in the same
> directory as other existing profile files, e.g. prefs.js

Hi Kai,

Thanks for your help. I modified the "test_ev_roots.txt" file, change the fingerprint with capital characters then it works. The EV green bar appears after I modify.

I will put the screen catch in the attachment.

Thanks a lot!
Robin Lin

Comment 15

[Robin Lin]

Attachment: TWCA EV simple test screen catch

This is my test result using Minefield 4.0b8pre.
The EV status bar appears in the URI toolbar.

Thanks for help.
Robin Lin

Comment 16

[Kathleen Wilson]

Attachment: Completed CA Information Document

Comment 17

[Kathleen Wilson]

I will try to start this discussion soon. I'll post an update to this bug when I do.

Comment 18

[Kathleen Wilson]

I am getting ready to start the discussion of this request to enable EV and turn on the code signing trust bit for the TWCA root cert.

https://bugzilla.mozilla.org/show_bug.cgi?id=745671

My notes indicate a few items that TWCA was planning to complete by September 30, as follows:

- Document Handling of IDNs in CP/CPS: "All IDNs certificate will be revoked before 2012/9/30."

- DNS names in SAN: "TWCA is modifying the CA system to comply with CAB Forum Baseline Requirements. It will be done before 2012/9/30."

- Long-Lived SSL certs: "TWCA UCA CPS section 4.2: 'The maximum validity of the SSL server certificate is 4 years and is subject to extension with the approval of PMA when there is a special need.' TWCA is modifying the CA system to comply with CAB Forum Baseline Requirements. It will be done before 2012/9/30."


Have those items been completed?

Are there new CP/CPS documents?
The URLs that I have are here: http://www.mozilla.org/projects/security/certs/pending/#TWCA

Comment 19

[Kathleen Wilson]

(In reply to Kathleen Wilson from comment #18) via email:

1. About the IDNs certificate, our last one IDNs certificate have been replaced by FQDN certificate on 21st, September. No any IDNs certificate is used by our customer now.

2. DNS names in SAN: We patched our CA system on 23rd, August. All issued SSL certificates contain the SAN extension.

3. We will publish a new CPS for public trusted certificate. The maximum validity will be set on 39 months since Baseline requirement has the rule to re-verify the registration information no longer than 39 months. This new CPS will be release on tomorrow and put it on our repository.

We set our target to compliant with Baseline Requirement on 30, September. We also conduct an external audit to review the compliance with BR to make sure that we have done this task.

I will inform you once our new CPS is put on the repository. Please let me know if you have more question.

Comment 20

[Robin Lin]

Just for the record. TWCA WebTrust for CA seal renew URL.

1.	The WebTrust for CA audit report and seal of the both Root CA and EVSSL issuing CA link is “https://cert.webtrust.org/ViewSeal?id=1322”.
2.	The WebTrust EV audit report and seal link is “https://cert.webtrust.org/ViewSeal?id=1323”.

Comment 21

[Robin Lin]

UPDATE EVSSL CA CPS URL:
http://www.twca.com.tw/picture/file/09271647-%E5%84%B2%E5%AD%98%E5%BA%AB%E8%87%BA%E7%81%A3%E7%B6%B2%E8%B7%AF%E8%AA%8D%E8%AD%89%E8%82%A1%E4%BB%BD%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8EV%20SSL%E6%86%91%E8%AD%89%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83%E6%86%91%E8%AD%89%E5%AF%A6%E5%8B%99%E4%BD%9C%E6%A5%AD%E5%9F%BA%E6%BA%96%28%E8%8B%B1%E6%96%87%E7%89%88%29.pdf

TWCA sub-CA CPS also has been change to this version for the Baseline Requirement compliance.

http://www.twca.com.tw/picture/file/10011019-%E5%84%B2%E5%AD%98%E5%BA%AB%E6%86%91%E8%AD%89%E5%AF%A6%E5%8B%99%E4%BD%9C%E6%A5%AD%E5%9F%BA%E6%BA%96%E5%85%A8%E7%90%83%E6%86%91%E8%AD%89%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83%E6%86%91%E8%AD%89%E5%AF%A6%E5%8B%99%E4%BD%9C%E6%A5%AD%E5%9F%BA%E6%BA%96%28%E8%8B%B1%E6%96%87%E7%89%88%29.pdf

Comment 22

[Kathleen Wilson]

The test website, https://evssldemo.twca.com.tw/index.html, isn't working in my Firefox browser. I get (Error code: sec_error_ocsp_unknown_cert).

Please test again, and also check that the EV test is still working.

Respond in this bug when ready, and I'll try again.

Comment 23

[Robin Lin]

Sorry for the fault.
The OCSP server has been fixed.
Please try again.

Comment 24

[Kathleen Wilson]

(In reply to Kathleen Wilson from comment #22)
> The test website, https://evssldemo.twca.com.tw/index.html, isn't working in

It's working for me now.

Comment 25

[Kathleen Wilson]

Attachment: Completed CA Information Document

Comment 26

[Kathleen Wilson]

I am now opening the first public discussion period for this request from TWCA to turn on the Code Signing trust bit and enable EV for the “TWCA Root Certification Authority” root certificate that is currently included in NSS.

For a description of the public discussion phase, see https://wiki.mozilla.org/CA:How_to_apply#Public_discussion

Public discussion will be in the mozilla.dev.security.policy newsgroup and the corresponding [e-mail] mailing list.

http://www.mozilla.org/community/developer-forums.html
https://lists.mozilla.org/listinfo/dev-security-policy
news://news.mozilla.org/mozilla.dev.security.policy

The discussion thread is called “TWCA Request to enable EV and turn on Code Signing trust bit”

Please actively review, respond, and contribute to the discussion.

A representative of TWCA must promptly respond directly in the discussion thread to all questions that are posted.

Comment 27

[Robin Lin]

Hi,

May we request one more EV OID: 2.16.158.3.1.6.5 We need 2 EV OIDs, 
   2.16.886.3.1.6.5
   2.16.158.3.1.6.5

The reason is the historical political problem in Taiwan.

Thanks,
Robin Lin

Comment 28

[Robin Lin]

TWCA has been update EV OID, the CP/CPS are also available:
CP:
http://www.twca.com.tw/picture/file/12031626-Public%20Key%20Infrastructure%20Policy.pdf

CPS:
http://www.twca.com.tw/picture/file/12031629-EV%20SSL%20CA%20Certification%20Practice%20Statement.pdf

The TWCA EV OID will use this:
1.3.6.1.4.1.40869.1.1.22.3

Also described as:
{ISO(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) TWCA(40869) certificates(1) policies(1) EV(22) class3(3) }

This will no conflict with others since this is our own OID extend from our PEN.

Comment 29

[Kathleen Wilson]

The public comment period for this request is now over. 

This request has been evaluated as per Mozilla’s CA Certificate Policy at

 http://www.mozilla.org/projects/security/certs/policy/

Here follows a summary of the assessment. If anyone sees any factual errors, please point them out.

To summarize, this assessment is for the request to turn on the Code Signing trust bit and enable EV for the “TWCA Root Certification Authority” root certificate that was included in NSS per bug #518503.

Section 4 [Technical]. I am not aware of instances where TWCA has knowingly issued certificates for fraudulent use. If anyone knows of any such issues or instances, please note them in this bug.

Section 6 [Relevance and Policy]. TWCA appears to provide a service relevant to Mozilla users. It is a commercial CA that provides a consolidated on-line financial security certificate service and a sound financial security environment, to ensure the security of on-line finance and electronic commercial trade in Taiwan. 

Policies are documented in the documents published on their website and listed in the entry on the pending applications list; the main documents of interest are the CP and CPS, which have been translated into English.

http://www.twca.com.tw/Portal/english/coporate_profile/Repository.html
On this page there are links to: CPS, CP, EV CPS, and sub-CA CPS.

Section 7 [Validation]. TWCA appears to meet the minimum requirements for subscriber verification, as follows:

* SSL: SSL certificates are issued under assurance level class 2 or 3. TWCA verifies the legal existence of the organization requesting the certificate, the identity and authorization of the certificate subscriber, and that the certificate subscriber has the exclusive right to use the domain name(s) to be listed in the certificate. This is documented in sections 2.2.1.1 and 5.1 of the CPS. According to the EV CPS, EV SSL certificates are only issued under assurance level class 3.

* Email: S/MIME certificates are issued under assurance level class 1, 2, or 3. TWCA verifies the identity of the subscriber, verifies the domain name ownership of the email address to be listed in the certificate, and exchanges email with the subscriber to confirm the application request. This is documented in sections 2.2.1.1 and 5.1 of the CPS.

* Code: According to CPS section 4.1.8, TWCA verifies the organization and the identity and authority of the certificate subscriber to request the code signing certificate on the organization’s behalf.

Section 15 [Certificate Hierarchy]. 
This root has internally-operated subordinate CAs, and no externally-operated subordinate CAs. All of the subCAs must follow TWCA UCA CPS to conduct their operations.

* EV Policy OID: 1.3.6.1.4.1.40869.1.1.22.3

* CRL 
http://RootCA.twca.com.tw/TWCARCA/revoke_2048.crl
http://sslserver.twca.com.tw/sslserver/EVSSL_Revoke_2011.crl
CPS section 5.4.9: CRL issuance frequency shall be 24 hours.

* OCSP
http://evssl_ocsp.twca.com.tw/

Sections 9-11 [Audit]. 
Annual audits are performed by SunRise CPAs’ Firm, a member firm of DFK, according to the WebTrust CA and WebTrust EV criteria and posted on the webtrust.org website.
https://cert.webtrust.org/ViewSeal?id=1322
https://cert.webtrust.org/ViewSeal?id=1323

Based on this assessment I intend to approve this request to turn on the Code Signing trust bit and enable EV for the “TWCA Root Certification Authority” root certificate.

Comment 30

[Erwann Abalea]

(In reply to Kathleen Wilson from comment #29)
> * OCSP
> http://evssl_ocsp.twca.com.tw/

The URL has been changed because of the illegal '_' character in a host or domain name.
It's now "http://evsslocsp.twca.com.tw".

Comment 31

[Kathleen Wilson]

To the representatives of TWCA: Thank you for your cooperation and your patience.

To all others who have commented on this bug or participated in the public discussion: Thank you for volunteering your time to assist in reviewing this CA request.

As per the summary in Comment #29, and on behalf of Mozilla I approve this request from TWCA to turn on the code signing trust bit and enable EV for the following root certificate.

** "TWCA Root Certification Authority" (websites, email, code signing), enable EV.

I will file the NSS bug to turn on the code signing trust bit, and the PSM bug to enable EV.

Comment 32

[Kathleen Wilson]

I have filed bug #823766 against NSS and bug #823770 against PSM for the actual changes.