Visa request to add the Visa Information Delivery Root CA certificate was withdrawn

This case was Visa’s request to include the Visa Information Delivery Root CA certificate in Mozilla’s root store. The request began with Visa providing root and PKI details, audit history, and supporting documentation, while Mozilla asked for public CP/CPS information, test websites, CRL testing, and later BR audit and self-assessment materials. Over time, Visa provided updated policy documents, audit statements, a BR self-assessment, and test URLs, and Mozilla noted several remaining issues during review. The thread also references related concerns about SHA-1 issuance and other Visa bugs, but the case itself stayed focused on this root inclusion request. In the end, Mozilla recorded that Visa emailed saying it wanted to withdraw the request for this SHA1 root, and Visa said it might open a new request for a new SHA2 Root and ECC Root CA.

1. 2005-06-27 Visa Information Delivery Root CA became valid.
2. 2011-02-24 Visa opened the request to add the Visa Information Delivery Root CA certificate.
3. 2016-12-22 Mozilla noted that Visa’s OCSP service was already implemented.
4. 2017-08-04 Visa attached its BR self-assessment.
5. 2018-05-24 Visa said it wanted to withdraw the request for this SHA1 root.

1. 2011-02-24 Visa — Visa opened the bug and provided general and technical information about the Visa Information Delivery Root CA.
2. 2011-03-04 Mozilla representative — Mozilla began information verification and asked for more public documentation and clarification about the CPS.
3. 2011-11-02 Visa — Visa resubmitted the request with revised information and responses to Mozilla’s recommended practices questions.
4. 2011-11-18 Mozilla representative — Mozilla asked for an HTTPS test site and reported a CRL import error in Firefox.
5. 2011-12-02 Visa — Visa said it had published a DER-encoded CRL and would provide an HTTPS URL.
6. 2013-05-29 Mozilla representative — Mozilla said the test website worked but CRL import still failed and OCSP was required under the Baseline Requirements.
7. 2015-09-01 Visa — Visa responded to Mozilla’s BR-related questions about audit statements, BR commitment, MFA, network security, and SHA-1 certificates.
8. 2015-09-14 Mozilla representative — Mozilla said the request still needed resolution of bug 1034834, a published CP/CPS with BR commitment, and a BR audit statement before public discussion.
9. 2016-08-02 Visa — Visa said it had finished its 2016 WebTrust audit and would provide the report when received from KPMG.
10. 2016-09-27 Mozilla representative — Mozilla noted that the BR audit had been provided.
11. 2016-10-12 Visa — Visa confirmed that all exceptions had been remediated and would not appear in the next BR audit report.
12. 2016-10-17 Mozilla representative — Mozilla said the Visa case was placed in the queue for public discussion.
13. 2017-04-17 Mozilla representative — Mozilla asked Visa to complete a BR self-assessment and attach it to the bug.
14. 2017-08-04 Visa — Visa attached the BR self-assessment.
15. 2017-08-15 Mozilla representative — Mozilla said two items still needed input: test website URLs and an updated audit statement.
16. 2018-05-03 Mozilla representative — Mozilla attached 2017 audit statements and moved the bug back to information verification.
17. 2018-05-24 Mozilla representative — Mozilla said Visa emailed that it wanted to withdraw the request for this SHA1 root.