TÜRKTRUST root CA inclusion request and review

This case is TÜRKTRUST’s request to add two root CA certificates to Mozilla’s root store. The bug was opened by TÜRKTRUST with details about its roots, CPS, audit status, and intended trust uses, including SSL, email, code signing, timestamping, and OCSP. Mozilla reviewers asked for public documentation, CRL details, hierarchy diagrams, and clearer statements in the CPS about email, SSL, and code-signing vetting. TÜRKTRUST responded with an English CPS, published audit letter URL, hierarchy diagrams, and explanations of its verification practices. After a public comment period, Mozilla approved the two TÜRKTRUST root CAs for inclusion and filed a follow-up NSS bug; this bug was then resolved FIXED.

1. 2007-05-14 TÜRKTRUST requested inclusion of two root CA certificates in Mozilla software certificate stores.
2. 2007-11-21 Mozilla completed its review and announced intent to approve the two TÜRKTRUST root CAs for inclusion.
3. 2008-01-02 Mozilla approved the TÜRKTRUST root CAs for inclusion after addressing the remaining concerns.
4. 2008-02-22 The bug was resolved FIXED after the related NSS inclusion bug was resolved.

1. 2007-05-14 Community commenter — TÜRKTRUST opened the bug to complete the formal request to add two root CA certificates and provided CA, audit, and certificate details.
2. 2007-05-23 Mozilla representative — Mozilla asked about the public availability of the auditor letter, CRL URLs, root naming, and whether the two roots served distinct uses.
3. 2007-06-14 Community commenter — TÜRKTRUST confirmed the CA information, said it had started correspondence to publish the letter on the auditor’s web domain, and explained the two roots were not for distinct uses.
4. 2007-07-04 Community commenter — TÜRKTRUST provided the published letter URL, daily CRL issuance, hierarchy diagrams, an English CPS, and section references for SSL verification.
5. 2007-08-15 Mozilla representative — Mozilla said it could not accept roots without a public, binding commitment to meet the minimum vetting criteria in the policy.
6. 2007-08-16 Community commenter — TÜRKTRUST said it would rewrite and extend its CPS to address the unclear minimum vetting criteria.
7. 2007-11-17 Hecker representative — Frank Hecker took over the review, asked whether the revised CPS was on TÜRKTRUST’s website, and began a preliminary assessment.
8. 2007-11-20 Community commenter — TÜRKTRUST provided the CPS URL on its website and answered questions about object signing certificates and annual audits.
9. 2007-11-21 Hecker representative — Mozilla completed its final assessment, opened public discussion, and said it was minded to approve the two root CAs.
10. 2007-11-27 Bolyard representative — A participant objected that trial certificates without authentication would be a show stopper if they validated like normal certificates.
11. 2008-01-02 Hecker representative — Mozilla said the trial-certificate issue was not relevant to this application because those certificates were under a separate root, and approved the two root CAs for inclusion.
12. 2008-01-04 Hecker representative — Mozilla filed bug 410821 for NSS inclusion of the two TÜRKTRUST root CA certificates.
13. 2008-02-22 Hecker representative — The bug was resolved FIXED after bug 410821 was resolved FIXED.