Request to add NetLock CA certificates

This case is a request to add NetLock CA root certificates to Mozilla/NSS. The CA operator is NetLock (Hungary) and the request covers four roots: NetLock Qualified (Class QA), NetLock Notary (Class A), NetLock Business (Class B), and NetLock Express (Class C). The request was triggered by questions about NetLock’s WebTrust audit status and by a separate issue tracked in bug 277797 affecting the Qualified CA. The Mozilla CA Program reviewer accepted a copy of NetLock’s WebTrust audit report (linked from the CA certificate list) as satisfying the WebTrust/WebTrust-equivalent audit requirement, and asked for answers about recommended trust bits and certificate usage for each class. NetLock provided responses indicating which certificate purposes each class supports, noting that the Qualified class does not issue SSL certificates. The reviewer approved the request based on successful completion of a WebTrust audit and filed bug 280744 for the actual addition of the certificates to NSS; later comments state that the Notary, Business, and Express roots were added, while the Qualified root was not added due to bug 277797. The bug was later marked resolved/fixed after a subsequent request for the new Netlock Class QA root cert in bug 313942.

1. 2005-01-25 Mozilla CA Program opened a request to add NetLock CA root certificates for inclusion.
2. 2005-01-28 Mozilla reviewer linked NetLock’s WebTrust audit report and requested trust-bit and usage details for each NetLock CA class.
3. 2005-02-02 Mozilla approved inclusion based on the WebTrust audit and initiated the NSS addition work via a separate bug.
4. 2005-04-13 NetLock Notary, Business, and Express roots were added to NSS; NetLock Qualified was not added due to the separate Qualified CA issue.
5. 2007-01-17 A later request for the new Netlock Class QA root cert was completed, and this bug was marked resolved/fixed.

1. 2005-01-25 Hecker representative — Explained NetLock’s four root CAs and noted uncertainty about WebTrust status, stating approval would depend on resolving WebTrust status and bug 277797.
2. 2005-01-26 Bolyard representative — Stated the qualified CA cert could not be added until bug 277797 was resolved.
3. 2005-01-28 Hecker representative — Linked a copy of NetLock’s WebTrust audit report and listed remaining issues, including trust bits and certificate usage questions for each CA class.
4. 2005-01-28 Netlock — Provided answers for each NetLock CA class regarding SSL server use, email use, and code-signing use, noting the qualified class does not issue SSL certificates.
5. 2005-02-02 Hecker representative — Approved the request based on NetLock’s successful WebTrust audit and filed bug 280744 for adding the certs to NSS.
6. 2005-04-13 Google representative — Reported that NetLock Notary, Business, and Express were added to NSS (for upcoming Mozilla releases) and that NetLock Qualified was not added due to bug 277797.
7. 2007-01-17 Bolyard representative — Noted that bug 313942 requested inclusion of the new Netlock Class QA root cert and marked this bug resolved/fixed.