DarkMatter root certificate inclusion request

This case is a request by DarkMatter LLC to add four root certificates to Mozilla/NSS: DarkMatter Root CA G3, DarkMatter Root CA G4, UAE Global Root CA G3, and UAE Global Root CA G4. DarkMatter opened the bug and provided root certificate details, CA information, audit materials, and a BR self-assessment. Mozilla reviewed the submission and identified several items needing clarification or correction, including BR section 2.2 test websites chaining to each requested root, CP/CPS clarity on CAA handling, certificate validity periods, private key escrow language, possible .ae constraints, and future audit statement content. During the discussion, participants also raised a separate misissuance involving two certificates issued by DarkMatter under a QuoVadis root, and Mozilla staff said that issue should be handled in a separate incident bug. A substantial part of this thread focused on whether DarkMatter had provided the required valid, revoked, and expired interoperability certificates chaining to each submitted root, with DarkMatter later stating it had created issuing CAs and updated the interoperability certificates for all four roots. The bug remained under review with Mozilla still requesting updated CPS information and clarification of the term "Bridge CA" in the CP/CPS. The case is now closed with resolution WONTFIX.

1. 2017-12-28 DarkMatter requested inclusion of four root certificates in NSS/Mozilla products.
2. 2018-01-31 DarkMatter submitted a corrected CA information document and a BR self-assessment.
3. 2018-05-09 Mozilla posted a verification summary identifying outstanding issues, including BR section 2.2 test websites and CP/CPS clarifications.
4. 2018-05-30 Two non-compliant certificates issued by DarkMatter under a QuoVadis subordinate CA were reported and DarkMatter said they were revoked and replaced.
5. 2018-07-01 DarkMatter said it would create issuing CAs and the required valid, revoked, and expired interoperability certificates for each submitted root.
6. 2018-07-10 DarkMatter said it had updated the interoperability certificates for all four submitted roots.
7. 2018-09-24 Mozilla requested clarification of the term "Bridge CA" in the CP and CPS.

1. 2017-12-28 DarkMatter LLC — Opened the bug requesting addition of four DarkMatter/UAE root certificates to NSS and Mozilla products.
2. 2017-12-31 DarkMatter LLC — Attached the completed root inclusion template, WebTrust assertions and auditor report, and a self-audit checklist.
3. 2018-01-10 Mozilla representative — Said the BR self-assessment might still be needed and linked Mozilla's information checklist.
4. 2018-01-31 DarkMatter LLC — Uploaded a corrected CA information document and attached the BR self-assessment in the requested format.
5. 2018-05-09 Mozilla representative — Attached a verification summary highlighting unresolved issues including CAA documentation, section 2.2 test sites, validity periods, escrow language, possible .ae constraints, and audit statement requirements.
6. 2018-05-10 DarkMatter LLC — Responded point-by-point to Mozilla's listed issues and explained DarkMatter's SOP and CPS update approach.
7. 2018-05-14 DarkMatter LLC — Provided repository and test-site URLs for valid, revoked, and expired certificates and asked what test output Mozilla wanted.
8. 2018-05-15 Mozilla representative — Said the provided test websites did not meet BR section 2.2 because the certificates did not chain to the corresponding requested roots, and asked for future CP/CPS updates.
9. 2018-05-22 DarkMatter LLC — Uploaded multiple addendum attachments related to Mozilla verification and test results.
10. 2018-05-22 Mozilla representative — Said Mozilla only needed confirmation that each test website certificate chained to the corresponding root and that errors had been resolved.
11. 2018-05-30 Sectigo — Reported two certificates whose Subject CN was not also present in SAN:dNSName and linked crt.sh records.
12. 2018-05-30 Quovadis representative — Said QuoVadis had identified the certificates in linting, informed DarkMatter, and that the certificates would be revoked.
13. 2018-05-30 DarkMatter LLC — Said DarkMatter had mis-issued two certificates, revoked them about 9.5 hours earlier, replaced them, and planned remediation including retraining and automated linting.
14. 2018-05-30 Community commenter — Said the misissuance should probably be handled in a separate bug with a full incident report.
15. 2018-06-02 Rossde representative — Suggested deferring public review until corrective actions were implemented, documented in CP/CPS, and verified by outside audit.
16. 2018-06-26 DarkMatter LLC — Asked about CT log account expectations for interoperability certificates and future issuance.
17. 2018-06-26 Community commenter — Replied that CT log questions should be taken to log operators and said Mozilla policy did not require the recommendations being requested.
18. 2018-06-26 Sectigo — Suggested public non-browser-policy CT logs for testing and provided two references.
19. 2018-06-27 DarkMatter LLC — Explained that DarkMatter's SOPs required successful CT log submission before issuance and described this as a difficulty for requested interoperability certificates chaining to the submitted roots.
20. 2018-06-27 Community commenter — Said the current approach did not meet BR section 2.2 and that DarkMatter had designed a policy creating extra work for itself.
21. 2018-06-30 DarkMatter LLC — Argued that the submitted roots were not yet publicly trusted and therefore the BR section 2.2 requirement did not yet apply in the way Ryan described.
22. 2018-06-30 Community commenter — Disagreed with DarkMatter's interpretation, said certificates from the root were publicly trusted for BR purposes, and asked DarkMatter to demonstrate the required section 2.2 certificates.
23. 2018-07-01 DarkMatter LLC — Said DarkMatter would create issuing CAs under each submitted root, create the three required interoperability certificates for each root, and update the web pages.
24. 2018-07-01 DarkMatter LLC — Acknowledged that DarkMatter lacked correctly chained interoperability certificates from BR section 2.2 and said this would be rectified that week.
25. 2018-07-10 DarkMatter LLC — Said DarkMatter had updated the interoperability certificates for all four submitted roots and that Mozilla was now waiting for an updated CPS.
26. 2018-09-24 Mozilla representative — Asked DarkMatter to explain the term "Bridge CA" as used in the CP and CPS.