Microsoft root inclusion request for two non-EV roots, with earlier review of four Microsoft roots

This case began as Microsoft’s request to add Microsoft roots to Mozilla’s root store. The review covered Microsoft’s CP/CPS documents, audit statements, test websites, and Mozilla policy questions about validation, SAN usage, revocation, and problem reporting. During the process, Mozilla approved inclusion of four Microsoft roots in 2019, but the case was later updated to reflect that only the two non-EV roots were actually added. In 2020, Microsoft said it was ready to include the two non-EV roots and provided the root URLs, test websites, audit statements, and CPS reference. In 2022, Mozilla closed the request as resolved/fixed because it had not been updated in two years and noted that Microsoft could open a new request for the EV roots if desired.

1. 2018-03-22 Microsoft opened a root inclusion request for Microsoft roots in Mozilla’s root store.
2. 2019-09-18 Mozilla approved inclusion of four Microsoft roots, including two EV roots.
3. 2020-05-23 Microsoft narrowed the request to two non-EV roots and provided test websites, audit statements, and CPS information.
4. 2022-03-15 Mozilla closed the request as resolved/fixed and noted that a new request could be opened for the EV roots.

1. 2018-03-22 Microsoft Corporation — Microsoft opened the request and attached the Microsoft Root Inclusion Application.
2. 2018-03-23 Mozilla representative — Mozilla acknowledged the request and asked Microsoft to attach its BR self-assessment.
3. 2018-06-20 Microsoft Corporation — Microsoft attached its BR self-assessment and later posted updated CP/CPS documents.
4. 2018-12-10 Microsoft Corporation — Microsoft said the CPS had been updated, audit statements were attached, revoked test websites were fixed, and lint testing and EV tests were complete.
5. 2019-09-18 Mozilla representative — Mozilla approved inclusion of Microsoft RSA Root Certificate Authority 2017, Microsoft ECC Root Certificate Authority 2017, Microsoft EV RSA Root Certificate Authority 2017, and Microsoft EV ECC Root Certificate Authority 2017.
6. 2020-05-23 Microsoft Corporation — Microsoft said it was ready to include only the two non-EV roots and provided test websites, audit statements, and the CPS URL.
7. 2022-03-15 Mozilla representative — Mozilla changed the request to reflect that only the two non-EV roots were added and closed the case as resolved/fixed.