Actalis request to add the Actalis Authentication Root CA for websites and code signing

Actalis opened this bug to request inclusion of the Actalis Authentication Root CA in Mozilla, with Websites and Code Signing trust bits. The request began with Actalis providing application details and the root certificate, and Mozilla then worked through information gathering, public discussion, and review of the CA’s CPS, hierarchy, OCSP, and audit materials. During the review, Mozilla asked Actalis to address the fact that the root directly issued end-entity certificates, to provide updated audit evidence, and to clarify operational details such as RA oversight and OCSP availability. Actalis responded by revising its CPS, moving to a two-level PKI with a subordinate CA for end-entity issuance, and later providing a new audit statement. Mozilla ultimately stated that the identified action items had been completed and approved inclusion of the Actalis Authentication Root CA for websites and code signing, then filed a follow-up NSS bug for the actual changes.

1. 2009-10-05 Actalis requested Mozilla inclusion of the Actalis Authentication Root CA for websites and code signing.
2. 2011-09-23 Actalis said it had revised its CPS and migrated to a two-level PKI with a subordinate CA issuing end-entity certificates.
3. 2012-02-20 Actalis reported a DigitPA audit and attached the audit report.
4. 2012-04-04 Mozilla approved inclusion of the Actalis Authentication Root CA for websites and code signing.

1. 2009-10-05 Staff representative — Actalis opened the request and said full information was in an attached document.
2. 2009-10-07 Mozilla representative — Mozilla began the information-gathering and verification phase.
3. 2011-05-17 Mozilla representative — Mozilla opened the first public discussion period for the root inclusion request.
4. 2011-08-15 Mozilla representative — Mozilla said Actalis needed to update the audit cycle to annual and complete the current audit before approval.
5. 2011-09-23 Staff representative — Actalis said it had revised its CPS, committed to annual audits if needed, and moved to a two-level PKI.
6. 2011-10-20 Mozilla representative — Mozilla confirmed the updated CPS addressed the earlier concerns, pending the new audit.
7. 2012-02-20 Staff representative — Actalis said it had been audited by DigitPA on January 23 and 24 and attached the report.
8. 2012-03-27 Staff representative — Actalis confirmed additional CA communication items, including baseline-requirements-related commitments.
9. 2012-04-04 Mozilla representative — Mozilla approved the request and said it would file the NSS bug for the actual changes.