iTrusChina root inclusion request and CP/CPS review for vTrus Root CA and vTrus ECC Root CA

This case was opened by iTrusChina Co., Ltd. to request Mozilla root inclusion for its vTrus Root CA and vTrus ECC Root CA. The company submitted CA information, hierarchy, BR self-assessment, and audit materials, and Mozilla asked it to complete CCADB access and create the root inclusion case there. During review, Mozilla requested clarifications and fixes in the CP/CPS, including EV test website readiness, OCSP issues, and several EV guideline requirements. iTrusChina responded with updated OCSP service information, revised CP/CPS versions, additional audit statements, and an EV test site for the ECC root. Mozilla later moved the case into public discussion, then announced intent to approve the inclusion request, and Kathleen Wilson approved inclusion of the two roots on 2021-11-08. The bug is resolved as FIXED.

1. 2019-05-28 iTrusChina requested Mozilla root inclusion for vTrus Root CA and vTrus ECC Root CA.
2. 2019-06-12 iTrusChina created the CCADB root inclusion case for the request.
3. 2020-09-17 Mozilla completed an initial CP/CPS review and raised questions for iTrusChina.
4. 2021-09-23 iTrusChina released CPS v1.4.7 and Mozilla reviewed it against EV Guidelines.
5. 2021-11-08 Mozilla approved inclusion of vTrus Root CA (Websites; EV) and vTrus ECC Root CA (Websites; EV).

1. 2019-05-28 iTrusChina Co., Ltd. — iTrusChina opened the bug and asked Mozilla to review its root inclusion application, audit reports, and BR self-assessment.
2. 2019-06-10 Mozilla representative — Kathleen Wilson said iTrusChina was not in CCADB and asked it to fill out the CCADB access application.
3. 2019-06-11 iTrusChina Co., Ltd. — iTrusChina said it had filled out the CCADB access form.
4. 2019-06-11 Mozilla representative — Kathleen Wilson said iTrusChina would receive email when the CCADB CA Community License was issued and then should create a root inclusion case in CCADB.
5. 2019-06-12 iTrusChina Co., Ltd. — iTrusChina said it had created the CCADB case and provided the Mozilla case link and root URLs.
6. 2019-06-18 Mozilla representative — Kathleen Wilson listed items needing clarification, including EV test website, OCSP errors, and whether the roots needed to issue outside *.cn.
7. 2019-06-19 iTrusChina Co., Ltd. — iTrusChina replied that it had an EV test website for RSA, planned one for ECC, and was working on OCSP and policy questions.
8. 2019-11-04 iTrusChina Co., Ltd. — iTrusChina said it had updated OCSP, revised its CPS to v1.3.1, and asked Mozilla to proceed.
9. 2019-11-18 Mozilla representative — Kathleen Wilson said the request was ready for detailed CP/CPS review and assigned it to Wayne.
10. 2020-04-09 iTrusChina Co., Ltd. — iTrusChina said it had updated its CP and CPS to version 1.4 and published them on its website.
11. 2020-05-27 iTrusChina Co., Ltd. — iTrusChina said it had completed the BR self-assessment based on BR 1.7.0 and CP/CPS 1.4.1.
12. 2020-09-17 Mozilla representative — Ben Wilson posted the initial CPS review findings and requested clarifications and fixes.
13. 2020-09-18 iTrusChina Co., Ltd. — iTrusChina said it would revise the CP/CPS and explained several review points, including external subordinate CAs and email certificates.
14. 2020-10-21 iTrusChina Co., Ltd. — iTrusChina uploaded CPS v1.4.2 and the corresponding CP.
15. 2020-12-29 iTrusChina Co., Ltd. — iTrusChina said it had updated CP and CPS to version 1.4.4 and asked for review.
16. 2021-03-15 Mozilla representative — Ben Wilson posted a CPS review of version 1.4.4 and marked several items fixed or OK.
17. 2021-03-18 iTrusChina Co., Ltd. — iTrusChina said it had completed the BR self-assessment and was ready for public discussion.
18. 2021-04-06 iTrusChina Co., Ltd. — iTrusChina said its annual WebTrust audit was complete and the report and seal were online.
19. 2021-04-07 Mozilla representative — Mozilla moved the case into public discussion and scheduled close of public discussion for 30-Apr-2021.
20. 2021-06-22 Mozilla representative — Mozilla extended public discussion to obtain a value justification.
21. 2021-07-02 iTrusChina Co., Ltd. — iTrusChina submitted a Quantifying Value document.
22. 2021-09-08 iTrusChina Co., Ltd. — iTrusChina said it had released CP v1.4.5 and CPS v1.4.6.
23. 2021-09-12 Mozilla representative — Ben Wilson posted an EV Guidelines review of CPS v1.4.6 and requested fixes for several sections.
24. 2021-09-18 iTrusChina Co., Ltd. — iTrusChina said it would revise the CPS and noted it did not currently purchase relevant commercial insurance.
25. 2021-09-23 iTrusChina Co., Ltd. — iTrusChina released CPS v1.4.7 and said it had added EV SSL requirements and corrected several descriptions.
26. 2021-09-23 Mozilla representative — Ben Wilson reviewed CPS v1.4.7 and marked the cited EV guideline issues fixed or OK.
27. 2021-10-27 Mozilla representative — Mozilla closed public discussion with an announcement of intent to approve the inclusion request.
28. 2021-11-08 Mozilla representative — Kathleen Wilson approved inclusion of vTrus Root CA and vTrus ECC Root CA and said NSS and PSM bugs would be filed for the changes.