CFCA EV ROOT inclusion request and public discussion

China Financial Certification Authority (CFCA) opened this bug to request inclusion of its root certificates in Mozilla’s trust store. The request initially covered the CFCA GT CA and CFCA EV ROOT roots, and CFCA provided root details, CPS documents, audit materials, and test information during review. Mozilla’s review identified issues in testing and discussion, including certificate chain problems for a test site and questions about EV code-signing scope, and CFCA responded with remediation plans and updated audit documents. The request was narrowed to the CFCA EV ROOT root certificate, with a second public discussion held after CFCA provided updated audit reports and CA information. Mozilla then completed its assessment and approved inclusion of the CFCA EV ROOT root certificate with websites trust and EV treatment, and filed follow-up NSS and PSM bugs for the implementation changes.

1. 2013-10-12 CFCA requested inclusion of its root certificate in Mozilla’s trusted root list.
2. 2014-06-19 Mozilla opened the first public discussion for CFCA’s root inclusion request.
3. 2014-09-04 The request was narrowed to the CFCA EV ROOT root certificate and additional remediation items were requested.
4. 2015-01-07 Mozilla opened the second public discussion for the CFCA EV ROOT request.
5. 2015-02-10 Mozilla approved inclusion of the CFCA EV ROOT root certificate with websites trust and EV treatment.

1. 2013-10-12 China Financial Certification Authority (CFCA) — CFCA asked to add its Root CA to Mozilla’s trusted root list and described the root’s intended uses and validity period.
2. 2014-03-11 China Financial Certification Authority (CFCA) — CFCA said its OCSP worked well, that it had given intermediates to a subscriber to fix a chain issue, and that its BR audit and CPS updates were in progress.
3. 2014-04-25 China Financial Certification Authority (CFCA) — CFCA said only OCA2 could issue code-signing certificates, that EV could not issue code signing, and that it would seek code-signing trust later if needed.
4. 2014-06-19 Mozilla representative — Mozilla opened the first public discussion for inclusion of the CFCA GT CA and CFCA EV ROOT roots and requested active participation from CFCA.
5. 2014-09-04 Mozilla representative — Mozilla said the request was now only for CFCA EV ROOT and asked CFCA to state its remediation plan and decide on re-audit arrangements.
6. 2014-10-31 China Financial Certification Authority (CFCA) — CFCA attached a BR audit plan and described its responses to the issues raised in public discussion.
7. 2015-01-07 Mozilla representative — Mozilla opened the second public discussion for the CFCA EV ROOT request.
8. 2015-02-04 Mozilla representative — Mozilla summarized its assessment and said it intended to approve inclusion of CFCA EV ROOT with websites trust and EV treatment.
9. 2015-02-10 Mozilla representative — Mozilla approved the request and said it would file NSS and PSM bugs for the actual changes.