NAVER Cloud Trust Services root inclusion request for NAVER Global Root Certification Authority

This case was NAVER Business Platform’s request to have its root certificate included in Mozilla’s root store. The request began with NAVER saying it had established a Root CA for issuing SSL certificates and wanted inclusion under Mozilla Root Store Policy. Mozilla asked for the CA information checklist, CPS, and later a BR self-assessment, and then performed detailed CP/CPS review and follow-up checks. During review, Mozilla raised questions about CPS clarity, domain validation, revocation, CRL/OCSP behavior, audit timing, and test-site errors; NAVER responded by revising its CPS multiple times and addressing the requested items. Mozilla later said the changes looked good, opened public discussion, and after that discussion concluded, approved inclusion of the NAVER Global Root Certification Authority for websites trust bit enablement. The bug was resolved as FIXED.

1. 2017-09-29 NAVER Business Platform requested Mozilla root inclusion for its Root CA.
2. 2019-05-16 Mozilla moved the request into detailed CP/CPS review.
3. 2020-10-21 Public discussion began for the root inclusion request.
4. 2020-11-18 Mozilla approved inclusion of the NAVER Global Root Certification Authority for websites.

1. 2017-09-29 Navercorp representative — NAVER said it had established a Root CA for SSL certificates and was applying for Mozilla root inclusion.
2. 2017-10-04 Mozilla representative — Mozilla asked why NAVER should be directly included rather than cross-signed and requested the CA information checklist.
3. 2018-05-23 Mozilla representative — Mozilla attached verified CA information and listed multiple CPS and testing issues needing clarification or further work.
4. 2018-09-13 Navercorp representative — NAVER said it had revised its English CPS and that the relevant CRL issue had been fixed.
5. 2019-05-16 Mozilla representative — Mozilla said the request was ready for detailed CP/CPS review and assigned it onward.
6. 2020-05-19 Navercorp representative — NAVER said it had added one intermediate certificate record, explained the audit timing, and said two non-compliant certificates had been immediately revoked.
7. 2020-06-30 Community commenter — Ryan posted an initial CP/CPS review and said more documentation was needed.
8. 2020-06-30 Mozilla representative — Ben posted additional CP/CPS review comments, including wording and process issues.
9. 2020-08-31 Navercorp representative — NAVER uploaded CPS v1.4.2 and responded to the second review comments.
10. 2020-09-13 Mozilla representative — Ben asked NAVER to look into CRL provisioning errors.
11. 2020-09-22 Navercorp representative — NAVER said it would replace the OCSP responder certificate with one valid for 90 days.
12. 2020-10-08 Mozilla representative — Mozilla said the changes looked very good and that it would prepare the inclusion application for public discussion.
13. 2020-11-18 Mozilla representative — Mozilla approved the request to include the NAVER Global Root Certification Authority for websites.