TunTrust Root CA inclusion request for ANCE/NDCA of Tunisia

Agence Nationale de Certification Electronique (ANCE/NDCA) of Tunisia opened this case to request inclusion of its new TunTrust Root CA in Mozilla’s root store. The initial submission included audit reports, a BR self-assessment, and a description of the new PKI hierarchy and key generation ceremony. Mozilla asked for clarification about two TunTrust Root CA certificates listed in CCADB, and ANCE/NDCA explained that only the second certificate was being requested for inclusion because it omitted the digitalSignature key usage. Mozilla then reviewed the CP/CPS, requested additional fixes, and later confirmed those items were addressed. The case moved into public discussion, after which Mozilla approved the request for inclusion of TunTrust Root CA (Websites); Not EV and filed an NSS bug for the actual changes.

1. 2019-10-10 ANCE/NDCA requested Mozilla inclusion of the new TunTrust Root CA.
2. 2019-10-31 ANCE/NDCA clarified that only the second TunTrust Root CA certificate was requested for inclusion.
3. 2021-03-15 Mozilla marked CP/CPS review items as fixed after TunTrust updated its documentation.
4. 2021-04-07 The request was moved into public discussion.
5. 2021-08-31 Mozilla approved inclusion of TunTrust Root CA (Websites); Not EV.

1. 2019-10-10 Certification representative — ANCE/NDCA opened the bug, requested inclusion of TunTrust Root CA, and linked the CCADB case and audit reports.
2. 2019-10-30 Mozilla representative — Mozilla asked why two TunTrust Root CA certificates existed and why both were being requested.
3. 2019-10-31 Certification representative — ANCE/NDCA explained the difference between the two root certificates and said only Root Case Record #2 was requested for inclusion.
4. 2019-11-11 Mozilla representative — Mozilla said it would remove the first instance of the root cert from CCADB to avoid confusion.
5. 2019-11-12 Mozilla representative — Mozilla said the request was ready for detailed CP/CPS review and asked for WebTrust seals when available.
6. 2019-11-26 Certification representative — ANCE/NDCA provided links to the WebTrust period-of-time audit reports and seals.
7. 2020-12-02 Certification representative — ANCE/NDCA said it had updated the CP/CPS and attached an updated version.
8. 2021-03-15 Mozilla representative — Mozilla marked several CP/CPS issues as fixed, including problem reporting, CAA checking, MFA for issuance-capable accounts, revocation timing, key-compromise notice, and CN/SAN handling.
9. 2021-04-07 Mozilla representative — Mozilla moved the case into public discussion and scheduled the close of public discussion for 30-Apr-2021.
10. 2021-06-14 Certification representative — ANCE/NDCA said it wanted to move forward with the inclusion request and attached a CA quantifying value document.
11. 2021-08-24 Mozilla representative — Mozilla closed public discussion and stated an intent to approve the inclusion request, starting a 7-day last call.
12. 2021-08-31 Mozilla representative — Mozilla approved the request to include TunTrust Root CA (Websites); Not EV and said it would file the NSS bug for the actual changes.
13. 2021-08-31 Mozilla representative — Mozilla filed bug 1728394 against NSS for the actual changes.