GlobalSign Root CA - R6 inclusion request and later BR compliance discussion
This case began as GlobalSign’s request to include the new "GlobalSign Root CA - R6" root certificate in Mozilla products. GlobalSign said the RSA-4096 root was created in 2014 and provided its checklist, BR self-assessment, CP/CPS updates, and audit reports as part of the inclusion review. Mozilla reviewers asked follow-up questions about the audit statements and CP/CPS language, and GlobalSign supplied updated documents and clarifications before public discussion and approval. Mozilla later approved inclusion of the root with Websites and Email trust bits and EV enabled, and filed the corresponding NSS and PSM implementation bugs. In 2019, the thread was reopened to discuss whether the root’s subject complied with the Baseline Requirements and whether newly issued cross-certificates to that root were BR-compliant; Mozilla staff stated that root inclusion does not grant permission to violate the BRs and that the cross-certificates were issued in violation of the then-current BRs. The thread does not record a later change to the original inclusion decision, but it does document the compliance concern and follow-on discussion.
- GlobalSign Root CA - R6 was created.
- Mozilla approved inclusion of GlobalSign Root CA - R6 with Websites and Email trust bits and EV enabled.
- Mozilla raised a Baseline Requirements compliance concern about the root’s subject and newly issued cross-certificates.
- GlobalSign nv-sa — GlobalSign opened the bug to request inclusion of the new RSA-4096 root certificate and provided download links and intended trust uses.
- Mozilla representative — Mozilla said the request was ready for detailed CP/CPS review and reassigned the bug to Wayne Thayer.
- Fastly representative — Wayne Thayer listed review questions and noted several CP/CPS and audit issues to be addressed before proceeding.
- GlobalSign nv-sa — GlobalSign uploaded updated CPS and CP documents and said they were ready to proceed with the next step.
- Fastly representative — Wayne announced that public discussion had begun and posted the inclusion request details for comment.
- Mozilla representative — Mozilla approved inclusion of GlobalSign Root CA - R6 and said the NSS and PSM bugs would be filed for the changes.
- Community commenter — Ryan Sleevi said the root’s subject did not comply with the Baseline Requirements and raised concern about whether the inclusion bug implied acceptance of the non-compliant cross-certificates.
- Fastly representative — Wayne stated that including a root does not implicitly permit BR violations and that the subordinate CA certificates were issued in violation of the then-current BRs.