Trustis root inclusion request stalled pending audit and policy clarifications
Trustis asked Mozilla to include the Trustis FPS Root CA certificate in the built-in root list. The request triggered a long review focused on audit evidence, public verifiability of the auditor’s statement, and whether Trustis documented reasonable verification of domain ownership for SSL and control of email accounts for email certificates. Trustis provided policy and disclosure documents, updated its CRL MIME type, and later said it would revise its PDS/CP and pursue a new audit, eventually planning to move to WebTrust for CAs and WebTrust for EV. Mozilla staff said the existing audit was too old and that the request should wait for updated documentation and a new audit. In March 2010, Trustis agreed it made sense to close the bug and open a new request when ready, and Mozilla said it would close the bug.
- Trustis requested inclusion of the Trustis FPS Root CA certificate in Mozilla’s root list.
- Trustis changed the CRL MIME type to application/pkix-crl.
- Mozilla said Trustis’s proposed approach could be sufficient if the updated PDS/CP showed reasonable measures and the procedures were audited.
- Mozilla agreed to close the stalled request and asked Trustis to file a new one when ready.
- Trustis representative — Trustis opened the bug to request inclusion of its FPS Root CA certificate and provided initial background and references.
- Mozilla representative — Mozilla asked Trustis to provide a standard plain-text set of CA details and certificate details for evaluation.
- Trustis representative — Trustis confirmed the pending-list entry was correct, said it had fixed the CRL MIME type, and explained why it did not plan a new audit at that time.
- Mozilla representative — Mozilla raised questions about SSL/email verification, the audit report’s reliance clause, and the certificate hierarchy.
- Trustis representative — Trustis answered the questions, said the audit approval had been obtained, and attached a hierarchy diagram.
- Trustis representative — Trustis said its auditors would re-issue a re-worded opinion letter to remove the confusing paragraph.
- Mozilla representative — Mozilla said it required a publicly verifiable audit statement and continued to question whether Trustis met section 7 verification requirements.
- Mozilla representative — Kathleen Wilson took over the review and asked for clearer statements on domain and email verification, a live website chain to the root, and the revised auditor letter.
- Trustis representative — Trustis said it would clarify verification procedures in the PDS and considered an ETSI audit using the same CP.
- Mozilla representative — Mozilla said the 2004 audit was too old and recommended updating the CP or CPS and proceeding toward a new audit.
- Mozilla representative — Mozilla said Trustis’s ETSI-based approach was acceptable and asked for updates to the PDS/CP and the new audit.
- Mozilla representative — Mozilla agreed to close the bug and invited Trustis to open a new request later.