Izenpe root inclusion request for SHA-256 root, EV enablement, and OCSP fixes

This case is Izenpe S.A.’s request to include its root certificate in Mozilla, which later narrowed to the SHA-256 root and EV enablement for its SSL services. The request began with Izenpe asking to be included after obtaining ISO 27001 and ETSI TS 101 456 certifications, and Mozilla asked for the standard root-inclusion information, audit evidence, and public documentation of certificate verification procedures. Over time, the thread also covered EV requirements, CRL/OCSP behavior, and whether the CA had the necessary public-facing documents and audits for SSL, code signing, and email-related certificates. Mozilla approved inclusion of the Izenpe.com root for web sites and code signing with EV enabled, and later Izenpe reported infrastructure changes including moving OCSP to port 80 and having the OCSP responder signed by the EV issuing CA. The bug is resolved fixed, and related implementation bugs were filed to make the approved changes in NSS and PSM.

1. 2006-11-27 Izenpe requested Mozilla inclusion of its CA root certificate.
2. 2009-07-13 Mozilla approved inclusion of the Izenpe.com root for web sites and code signing, with EV enabled.
3. 2010-05-11 Izenpe fixed the OCSP behavior for the EV site used in testing.

1. 2006-11-27 Izenpe representative — Izenpe said it had obtained ISO 27001 and ETSI TS 101 456 certifications and wanted to be included in Mozilla.
2. 2007-02-09 Mozilla representative — Mozilla put the request on hold pending policy work on whether sub-country governmental CAs met the service requirement.
3. 2009-03-30 Mozilla representative — Mozilla accepted the bug and began information gathering and verification.
4. 2009-07-30 Mozilla representative — Mozilla said SSL, code signing, and email verification procedures still needed publicly available audited documentation that satisfied section 7 of the Mozilla CA Policy.
5. 2010-03-24 Izenpe representative — Izenpe said it would modify its OCSP service for the SSL EV sub-CA and provided the related bug number 554598.
6. 2010-05-11 Mozilla representative — Mozilla confirmed the OCSP test site was working and said the request was next in the queue for public discussion.
7. 2010-07-13 Mozilla representative — Mozilla approved the request to include the Izenpe.com root certificate for web sites and code signing, enabling EV.