ComSign root inclusion request for ComSign CA and ComSign Secured CA

This bug is a request from ComSign to add two root certificates to Mozilla: ComSign CA and ComSign Secured CA. The request began with ComSign asking Mozilla to add its certificates, and Mozilla then asked for CA details, audit evidence, CP/CPS links, hierarchy information, and validation practices. Over the course of the thread, ComSign provided the requested materials, including hierarchy diagrams, audit letters, CPS links, and examples of certificates chaining to the roots. Mozilla reviewed the submission, asked follow-up questions about audit criteria, validation text, and trust bits, and ComSign responded with additional documentation and clarifications. Mozilla later stated that the audit authenticity had been verified and that the request was ready for public discussion. After the second public discussion, Mozilla approved adding the two roots to NSS with trust bits set to email only for ComSign CA and SSL/object signing for ComSign Secured CA, and the bug was then tied to NSS bug 490487 for the actual changes.

1. 2008-03-03 ComSign requested Mozilla add the ComSign CA and ComSign Secured CA roots
2. 2009-04-08 Mozilla recorded that ComSign had completed the information-gathering and verification phase
3. 2009-04-28 Mozilla approved adding ComSign CA and ComSign Secured CA to NSS with specified trust bits
4. 2009-04-28 Mozilla filed NSS bug 490487 for the implementation work

1. 2008-03-03 Comda representative — ComSign asked Mozilla to add three certificates and described its services and SSL example site.
2. 2008-10-14 Mozilla representative — Mozilla accepted the bug and requested detailed CA, certificate, audit, and policy information.
3. 2008-11-03 Comda representative — ComSign supplied updated CPS links, validation statements, hierarchy information, and noted it removed the CRL critical flag.
4. 2008-11-04 Mozilla representative — Mozilla said the audit letter was addressed to Microsoft, asked for clearer CPS evidence for validation practices, and sought confirmation of trust bits.
5. 2009-03-09 Mozilla representative — Mozilla summarized the first public discussion and asked ComSign to clarify audit criteria and mapping to Mozilla policy.
6. 2009-04-08 Mozilla representative — Mozilla said the audit authenticity had been verified and that the request was ready for public discussion.
7. 2009-04-28 Hecker representative — Mozilla approved the request and asked Kathleen to file the NSS implementation bug and link it as a dependency.
8. 2009-04-28 Mozilla representative — Kathleen filed bug 490487 against NSS for the actual changes.