Request to add Wells Fargo root CA certificate

This case is a request to add the Wells Fargo root CA certificate to Mozilla/NSS. The request was initiated after Wells Fargo asked to be added, and the CA was noted as already being present in the Microsoft and Apple root lists. In the discussion, Wells Fargo provided details about its hierarchy: the Wells Fargo Root CA is an offline CA that issues only to two sub-CAs (one decommissioned and one active issuing S/MIME and client authentication, code signing, and SSL server certificates). The CA also described certificate policy mappings and revocation/validation information, including CRL publication intervals for the subordinate and root CAs and OCSP support (including an OCSP responder URL for the root CA). Frank Hecker reviewed the CPS and related information, stated there were no known technical issues, and indicated Wells Fargo appeared to meet Mozilla CA policy minimum requirements, including completion of an independent WebTrust for CAs audit by KPMG. He then approved inclusion of the Wells Fargo root CA certificate for NSS/Mozilla and filed a related NSS bug (Bug 344394). The request was later marked resolved/fixed after NSS 3.11.4 included the requested root.

1. 2006-06-28 A request was received to add the Wells Fargo root CA certificate to Mozilla/NSS.
2. 2006-07-12 Mozilla approved inclusion of the Wells Fargo root CA certificate for NSS/Mozilla and initiated the related NSS change.
3. 2007-01-17 The related NSS inclusion work was confirmed as resolved/fixed and this request was marked resolved/fixed.

1. 2006-06-28 Hecker representative — Frank Hecker said he received a request from Wells Fargo to add their root CA certificate and noted Wells Fargo is already in Microsoft and Apple root lists.
2. 2006-07-05 Hecker representative — Frank Hecker asked whether there are subordinate CAs under the Wells Fargo Root CA and, if so, how many and what they issue.
3. 2006-07-05 Wellsfargo representative — Wells Fargo stated there are two sub-CAs: one decommissioned (CRL-only) and one active issuing S/MIME/client authentication, code signing, and SSL server certificates; the root is offline and issues only to sub-CAs and infrastructure entities.
4. 2006-07-05 Hecker representative — Frank Hecker asked whether the 2004 CPS policy OIDs and their mapping to certificate uses (including SSL server issuance under System vs Personal) were still correct.
5. 2006-07-05 Wellsfargo representative — Wells Fargo confirmed the policy OIDs are correct and mapped S/MIME/client auth to the Personal policy, code signing to the Organization policy, and SSL certs to the System policy.
6. 2006-07-06 Hecker representative — Frank Hecker discussed identification and authentication policy requirements in the 2004 CPS and how they appear to satisfy Mozilla policy minimum requirements.
7. 2006-07-06 Hecker representative — Frank Hecker added details about CRL publication intervals for subordinate vs root CAs and stated OCSP is supported, including a root OCSP responder URL.
8. 2006-07-06 Hecker representative — Frank Hecker provided detailed comments relating Wells Fargo to Mozilla CA certificate policy, including audit completion (WebTrust for CAs by KPMG) and an inclination to approve inclusion.
9. 2006-07-12 Hecker representative — Frank Hecker said the comment period was over and approved the Wells Fargo root CA certificate for inclusion in NSS/Mozilla, planning to file the requisite NSS bug.
10. 2007-01-17 Bolyard representative — Nelson B. stated Bug 344394 was resolved/fixed, NSS 3.11.4 included the requested root, and he marked this request resolved/fixed.