DigiNotar request to add and later EV-enable the DigiNotar Root CA
This case began as DigiNotar’s request to add its root certificate and related CA information to Mozilla’s root program. Mozilla asked DigiNotar to provide the required CA details, certificate data, audit information, and confirmation that the submitted information was correct. During review, Mozilla limited the request to the root certificate only, and later separated EV approval from the basic root inclusion. The thread also covered DigiNotar’s email-validation practices, CRL encoding, and EV audit documentation. Mozilla ultimately approved inclusion of the DigiNotar Root CA for SSL and code signing, then later approved EV enablement for that root after the remaining issues were addressed. The bug was then marked fixed after the related NSS implementation work was completed.
- DigiNotar requested inclusion of its root CA certificates in Mozilla.
- Mozilla approved inclusion of the DigiNotar Root CA certificate for SSL and code signing only.
- Mozilla approved EV enablement for the DigiNotar Root CA.
- The bug was resolved as fixed after the related implementation work.
- Diginotar representative — DigiNotar opened the request and listed its root and subordinate CA certificates, audit claims, and download URLs.
- Mozilla representative — Mozilla said only root CAs are included and asked DigiNotar to provide the required application details in plain text.
- Diginotar representative — DigiNotar confirmed the information was correct and supplied a revised CA summary and ETSI audit link.
- Mozilla representative — Mozilla said it could not enable email trust unless DigiNotar verified control of the email address associated with the certificate.
- Hecker representative — Mozilla completed review and said it was minded to approve the DigiNotar Root CA for email, SSL, code signing, and EV, pending public discussion.
- Hecker representative — After public discussion, Mozilla decided to consider the application for SSL and code signing only and postpone email approval.
- Bolyard representative — Mozilla reported technical issues with some DigiNotar certificates, including an OCSP response problem for EV certificates.
- Mozilla representative — Mozilla reopened processing for EV enablement and asked DigiNotar to address CRL encoding, OCSP timing, subordinate CA, and audit questions.
- Diginotar representative — DigiNotar said it had changed its CRLs to DER format at all CDP locations.
- Mozilla representative — Mozilla summarized the evaluation and said the request was for EV enablement of the already-included DigiNotar Root CA.
- Hecker representative — Mozilla approved DigiNotar’s request to enable the DigiNotar Root CA for EV.
- Mozilla representative — Mozilla filed bug 493265 for the actual EV enablement changes.
- Bolyard representative — The bug was resolved as fixed, referencing the checkin for bug 493709.