CNNIC root inclusion request for Mozilla trust store

This case is CNNIC’s request to add the CNNIC ROOT certificate to Mozilla and enable the Websites trust bit. CNNIC opened the bug with its root certificate details, audit information, CPS, and a sample site, and Mozilla then began the information-gathering and verification process. The thread records follow-up questions about visibility, the root download URL, and CNNIC’s policies and practices, followed by public discussion of the request. Mozilla later approved the request and filed a separate NSS bug to make the actual changes. The bug was then marked resolved, and later comments in the thread shifted to objections and calls for removal, which Mozilla directed to a separate bug.

1. 2009-02-04 CNNIC requested Mozilla add the CNNIC ROOT certificate with Websites trust.
2. 2009-10-28 Mozilla approved inclusion of the CNNIC ROOT certificate with the Websites trust bit.
3. 2009-12-18 CNNIC ROOT was confirmed as a Builtin Object Token in Firefox 3.6.
4. 2010-02-04 Mozilla redirected removal follow-up to bug 542689.

1. 2009-02-04 Cnnic representative — CNNIC filed the inclusion request with root certificate details, audit information, and a request for SSL trust.
2. 2009-02-06 Mozilla representative — Mozilla accepted the bug to begin information gathering and verification.
3. 2009-02-11 Mozilla representative — Mozilla asked CNNIC to make the bug public, clarify organizational status, provide a working root download URL, and address problematic practices.
4. 2009-02-16 Cnnic representative — CNNIC replied with a corrected root download URL and answers about its organization and certificate practices.
5. 2009-10-13 Mozilla representative — Mozilla opened the first public discussion period for the CNNIC ROOT inclusion request.
6. 2009-10-22 Mozilla representative — Mozilla summarized the assessment and said it intended to approve the request.
7. 2009-10-28 Mozilla representative — Mozilla approved inclusion of the CNNIC ROOT certificate with Websites trust.
8. 2010-02-04 Mozilla representative — Mozilla said further follow-up about removal should be posted in bug 542689 instead of this closed bug.