ISRG / Let's Encrypt root certificate inclusion request for ISRG Root X1

This case is a Mozilla CA Program request from Internet Security Research Group (ISRG) to include the ISRG Root X1 root certificate and enable the Websites trust bit. The request was opened by Josh Aas of ISRG and included the root certificate details, CP/CPS links, and audit information for Let’s Encrypt. During review, Mozilla asked ISRG to provide a test website that chained to the root being included, and ISRG updated the server so the test site could be successfully verified. The public discussion also included questions about audit timing and certificate revocation practices, but the inclusion review itself concluded with approval. Mozilla later approved the request and filed the corresponding NSS bug for the actual change.

1. 2015-09-14 ISRG requested inclusion of the ISRG Root X1 root certificate for Websites trust.
2. 2016-04-20 Mozilla opened the public discussion period for the ISRG Root X1 inclusion request.
3. 2016-04-23 The test website was updated so it chained to ISRG Root X1 and could be successfully tested.
4. 2016-07-27 Mozilla approved inclusion of ISRG Root X1 and the Websites trust bit.
5. 2016-07-27 Mozilla filed NSS bug 1289889 for the actual root-store change.

1. 2015-09-14 Kflag representative — Josh Aas opened the request with ISRG and Let’s Encrypt root, certificate, and audit details.
2. 2015-09-28 Mozilla representative — Kathleen Wilson said the request had been entered into Salesforce and asked ISRG to review the attached CA information for corrections and missing details.
3. 2015-11-09 Kflag representative — ISRG corrected several CA policy and audit-related details and pointed to a point-in-time readiness assessment.
4. 2015-12-07 IdenTrust Services, LLC — IdenTrust explained its audit coverage and stated that the Let’s Encrypt subordinate CA certificate would be included in the next audit cycle.
5. 2016-01-07 Rossde representative — A commenter raised concerns about a reported subscriber certificate used in a malware campaign and said Let’s Encrypt declined to revoke it.
6. 2016-04-20 Mozilla representative — Mozilla opened public discussion and asked for a test website that chained to the root under review.
7. 2016-04-23 Mozilla representative — Mozilla confirmed the test website now chained to ISRG Root X1 and could be tested successfully.
8. 2016-07-20 Mozilla representative — Mozilla posted its assessment summary and said it intended to approve the request.
9. 2016-07-27 Mozilla representative — Mozilla approved the request and said it would file the NSS bug for the change.
10. 2016-11-17 Mozilla representative — Mozilla updated the test websites list to include valid, expired, and revoked ISRG Root X1 test sites.