Sectigo: Reseller ZeroSSL and Private Key Generation

This case involves Sectigo's reseller, ZeroSSL, and concerns the generation and storage of private keys for SSL certificates. The issue was raised regarding whether ZeroSSL's practices violated Mozilla's Root Store Policy, specifically around the generation and storage of private keys. After discussions and clarifications from ZeroSSL, it was established that private keys are generated client-side and stored securely. The Mozilla representative, Ben Wilson, ultimately concluded that the process does not expose private keys in a way that violates policy, leading to the bug being closed as invalid.

1. 2021-03-19 Initial concerns raised about ZeroSSL's private key generation and storage practices.
2. 2021-03-31 Bug closed as invalid after confirming no policy violation.

1. 2021-03-19 Mozilla representative — Raised concerns about ZeroSSL's private key generation process potentially violating Mozilla's Root Store Policy.
2. 2021-03-19 Sectigo — Defended ZeroSSL's practices, stating they do not generate keys and thus do not violate policy.
3. 2021-03-31 Mozilla representative — Concluded that ZeroSSL's key generation process does not present an issue and closed the bug.