KIR S.A. root inclusion request for SZAFIR ROOT CA

This case is KIR S.A.'s request to include the SZAFIR ROOT CA in Mozilla's Root Certificate Program. The request began in December 2012 and moved through information verification, public discussion, and follow-up review of KIR's CP/CPS, audit statements, and technical compliance details. Mozilla asked KIR to address Baseline Requirements issues including OCSP/CRL behavior, revocation handling, certificate profiles, and the treatment of ELIXIR certificates. KIR reported updates to its CPS and CP, provided audit statements, and made additional technical changes, including adding clientAuth EKU to future ELIXIR certificates and fixing OCSP/header issues. Mozilla later approved the request for the original root, and the thread also records later updates for a regenerated root certificate and related NSS work.

1. 2012-12-04 KIR opened a request to include SZAFIR ROOT CA in Mozilla's root program.
2. 2014-09-24 Mozilla opened the first public discussion period for the root inclusion request.
3. 2015-02-09 Mozilla opened the second public discussion period for the request.
4. 2015-04-22 Mozilla approved inclusion of SZAFIR ROOT CA for websites, email, and code signing.
5. 2015-12-08 Mozilla updated the discussion for the regenerated root certificate and noted no concerns were raised.

1. 2012-12-04 Kir representative — KIR opened the bug and attached the initial CA information and an example certificate.
2. 2012-12-22 Mozilla representative — Mozilla started information verification and clarified that the request was for inclusion of SZAFIR ROOT CA.
3. 2014-02-11 Mozilla representative — Mozilla asked KIR to revoke the old intermediate certificate, re-evaluate BR compliance, and provide a BR audit statement.
4. 2014-03-11 Kir representative — KIR said all new SSL certs would be BR-compliant and that it would start using a new intermediate certificate after acceptance.
5. 2014-09-24 Mozilla representative — Mozilla opened the first public discussion period for inclusion of SZAFIR ROOT CA.
6. 2014-10-30 Mozilla representative — Mozilla listed action items for CPS and CRL updates before the second discussion period.
7. 2014-11-20 Kir representative — KIR said it had completed the action items and published updated CPS and CP documents.
8. 2014-11-21 Kir representative — KIR responded to revocation-related concerns and said it had started publishing CRLs with AKI and IDP.
9. 2015-01-21 Kir representative — KIR clarified that ELIXIR certificates have no EKU extension and are not for server authentication, and offered to add clientAuth EKU.
10. 2015-01-23 Kir representative — KIR reported a test showing Firefox returned ssl_error_bad_cert_domain when an ELIXIR cert was used as an SSL cert.
11. 2015-01-28 Kir representative — KIR said future ELIXIR certificates would include id-kp-clientAuth starting 2015-02-15 and that CPS would be updated.
12. 2015-02-09 Mozilla representative — Mozilla opened the second public discussion period for the request.
13. 2015-04-22 Mozilla representative — Mozilla approved the request for SZAFIR ROOT CA with websites, email, and code signing trust bits.
14. 2015-12-08 Mozilla representative — Mozilla updated the discussion for the regenerated root certificate and noted the replacement root data had been added to bug 1157375.