ANF root inclusion request for ANF Server CA and ANF Global Root CA

This case is ANF Autoridad de Certificación’s request to include its root certificates in Mozilla, initially for the ANF Server CA root and later also for ANF Global Root CA SHA256. The request began with ANF providing root certificate data, CPS/CP documents, audit statements, and test websites for validation and EV testing. During review, Mozilla asked ANF to clarify which roots were in scope, provide audit evidence, fix OCSP and certificate lint issues, and respond to CA communications. ANF reported reissued certificates, updated documents, and new audit reports, and Mozilla opened two public discussion periods for the request. The thread ends with ANF still being asked to make the requested fixes and provide updated evidence, while Mozilla had not yet completed inclusion in the thread shown.

1. 2010-03-26 ANF submitted a root certificate for Mozilla inclusion review.
2. 2014-06-19 Mozilla opened the first public discussion for inclusion of ANF Server CA and ANF Global Root CA.
3. 2015-12-09 Mozilla opened the second public discussion for ANF Global Root CA.
4. 2016-01-19 Mozilla published its assessment and said it intended to approve ANF Global Root CA inclusion.

1. 2010-03-26 Autoridad de Certificación (ANF AC) — ANF opened the bug and described its root certificate and certificate usages, linking to the CPS.
2. 2010-04-01 Mozilla representative — Mozilla accepted the bug and started information gathering and verification.
3. 2010-04-06 Autoridad de Certificación (ANF AC) — ANF said it had reissued its CA certificate to fix the AuthorityKeyIdentifier problem and provided a new PEM certificate.
4. 2014-01-14 Mozilla representative — Mozilla asked ANF to clarify which root certificates were requested and to provide test websites and EV details.
5. 2014-02-07 Autoridad de Certificación (ANF AC) — ANF said it wanted only ANF Server CA and ANF Global Root CA SHA256 included.
6. 2014-03-18 Autoridad de Certificación (ANF AC) — ANF selected EV OID 1.3.6.1.4.1.18332.55.1.1.2.22.
7. 2014-06-19 Mozilla representative — Mozilla opened the first public discussion period for inclusion of ANF Server CA and ANF Global Root CA, websites trust bit, and EV treatment for ANF Global Root CA.
8. 2014-09-18 Mozilla representative — Mozilla said the first public discussion was over and listed remediation, re-audit, and updated audit statements as required before a second discussion.
9. 2015-06-22 Autoridad de Certificación (ANF AC) — ANF said it had updated audits and fixed mistakes, and provided new SSL and EV test URLs and audit links.
10. 2015-12-09 Mozilla representative — Mozilla opened the second public discussion period for ANF Global Root CA inclusion, websites trust bit, and EV treatment.
11. 2016-01-19 Mozilla representative — Mozilla summarized the request and said it intended to approve inclusion of ANF Global Root CA with the websites trust bit and EV treatment.
12. 2016-02-03 Community commenter — Ryan Sleevi said the root and CPS still appeared non-compliant with Baseline Requirements and urged rejection or a new audit.
13. 2016-02-09 Autoridad de Certificación (ANF AC) — ANF argued the cited BR issues did not apply to the root certificate and said it still requested inclusion.
14. 2016-11-17 Mozilla representative — Mozilla noted audit statements and said it was still seeing lint testing errors for the root certificate.
15. 2016-12-29 Autoridad de Certificación (ANF AC) — ANF attached updated 2036 root and EV CA certificates.
16. 2017-01-02 Mozilla representative — Gerv explained that crt.sh would need the certificate uploaded to a CT log to test it.