LuxTrust root inclusion request for LuxTrust Global Root 2 and EV enablement

LuxTrust opened this bug to request Mozilla inclusion of its root certificate and to enable Websites trust and EV treatment. The request began with LuxTrust providing CA information and later expanded to cover the replacement root, LuxTrust Global Root 2, after Mozilla identified compliance issues in the original hierarchy. During the review, Mozilla asked for audit statements, EV testing, clarification of RA roles, and fixes for OCSP and certificate policy issues; LuxTrust responded by updating CPS documents, renewing the SSL CA, and publishing new test and audit materials. LuxTrust also reported that it implemented a new OCSP solution and issued a new SSL CA 5 under LuxTrust Global Root 2, with EV-readiness tests succeeding on the updated test site. Mozilla then approved the request for the LuxTrust Global Root 2 certificate with Websites trust and EV enabled, and noted that follow-up NSS and PSM bugs would handle the actual changes.

1. 2013-11-29 LuxTrust requested Mozilla inclusion of its root certificate and related SSL/Code Signing trust.
2. 2016-02-26 LuxTrust reported replacing the original root with LuxTrust Global Root 2 and planning a new SSL CA 5.
3. 2016-05-31 LuxTrust said SSL CA 5 and a new OCSP solution had been implemented and asked to proceed with the second public discussion.
4. 2016-10-05 Mozilla approved inclusion of LuxTrust Global Root 2 with Websites trust and EV enabled.

1. 2013-11-29 Luxtrust representative — LuxTrust opened the bug and said it wanted Mozilla trust for SSL and code signing certificates under LuxTrust Global Root CA.
2. 2013-12-16 Mozilla representative — Mozilla accepted the bug and said it would begin information verification later.
3. 2014-02-28 Luxtrust representative — LuxTrust said its external audit was done and EV validation was in scope.
4. 2014-05-30 Luxtrust representative — LuxTrust said its current audit statement would be sent by mid-June and that its subordinate CA information was disclosed.
5. 2014-10-24 Luxtrust representative — LuxTrust explained the EV test issue, said the SSL CA would be renewed, and updated the BR commitment in its CPS.
6. 2015-01-26 Luxtrust representative — LuxTrust clarified that only LuxTrust S.A. and Chambre de Commerce issue SSL, EV SSL, and code signing certificates, and said future audit statements would mention PTC-BR.
7. 2015-02-12 Mozilla representative — Mozilla opened the first public discussion for inclusion of LuxTrust Global Root and EV treatment.
8. 2015-08-20 Mozilla representative — Mozilla closed the first discussion and listed action items about revocation, SHA-1, Netscape Cert Type, and CPS updates.
9. 2016-01-11 Luxtrust representative — LuxTrust provided the 2015 audit statements.
10. 2016-02-26 Luxtrust representative — LuxTrust said the original root lacked basicConstraints because of its creation date, and that LT Global Root CA 2 was replacing it.
11. 2016-03-09 Mozilla representative — Mozilla said LuxTrust could continue the request with LT Global Root CA 2 and asked for the root download URL and EV test site details.
12. 2016-05-31 Luxtrust representative — LuxTrust reported that SSL CA 5, EV testing, and OCSP fixes were complete and asked to proceed with the second public discussion.
13. 2016-06-01 Mozilla representative — Mozilla said it would be able to proceed with the second public discussion, but noted a revocation-check error.
14. 2016-06-21 Luxtrust representative — LuxTrust said the OCSP patch had been applied and the revocation-check error was gone.
15. 2016-10-05 Mozilla representative — Mozilla approved the request for LuxTrust Global Root 2 with Websites trust and EV enabled.