Information checklist for CAs applying for inclusion in Mozilla

In order to support cryptographic applications, such as those that make TLS connections to web and other servers, and those that sign and encrypt/decrypt email, Firefox and other Mozilla-based products contain digital certificates and related metadata for multiple Certification Authorities (CAs). By including the CA certificates and various associated pre-set metadata values Mozilla-based products can recognize as valid the end entity certificates that are issued under such CAs and are associated with, e.g., web servers, and email senders.

Example and Template

The example and template below list the information that must be provided by the CA in their root inclusion or update request as per step 1 of Mozilla's Application Process.

• Example -- This is what it will look like when you create a Root Inclusion Case directly in the CCADB.

Mozilla's process is public-facing, so all information that will be taken under consideration during the root inclusion request must be publicly available and provided by the CA via a Case in the CCADB and in a Bugzilla bug report. (Both must be created as they will reference each other.)

Adding Root Certificates and Creating Root Inclusion Cases

Access the CCADB

If your CA does not yet have access to the CCADB, then you may request access here:

• https://ccadb.org/cas/request-access

Information and instructions for CAs about the CCADB are here:

• https://www.ccadb.org/cas/

Create an "Add/Update Root Request" case

CAs provide information about their CA organization and root certificates by creating an "Add/Update Root Request".

1. Create an "Add/Update Root Request" case in the CCADB
   • Detailed Instructions: Create an Add/Update Root Request
2. Add new root certificates to the case.
   • In the ROOT INFORMATION tab, click on the "Add/Select Root Certificates" button. Then click on the "Add Root Certificate to CCADB" button and paste the certificate PEM into the window and click on "Validate PEM". If validation is successful, click on the "Create Root Certificate in CCADB" button.
3. Completely fill in the information in the five tabs of the "Add/Update Root Request" case: CA OWNER, AUDITS, POLICY DOCUMENTS, ROOT INFORMATION, and TEST WEBSITES.
4. Click on the "Submit to Root Store" button.

Important:

• Audit statements must meet the requirements listed in section 5.1 of the CCADB Policy and in section 3 of the Mozilla Root Store Policy.
  • Also see Mozilla's audit lifecycle requirements
• CCADB automatically converts WebTrust Seal URLs into PDF URLs when you click on ‘Save’
• In each audit statement section in the AUDITS tab, be sure to select "Applicable Root Certificates".
  • Click on the inverted triangle ("Edit") to select all of the root certificates covered by the audit.
• If you are requesting that the Websites (TLS) trust bit be enabled for your root certificate(s), then be sure to provide the 3 test websites (valid, expired, revoked) in the TEST WEBSITES tab.
  • Click on the "Validate Test Websites" button, resolve all failures, then click on the "Re-run Validation" button to make sure all the websites have Status of PASS.
• Add records to the CCADB for all existing intermediate certificates chaining up to the new root certificate(s).
  • https://www.ccadb.org/cas/intermediates

Create a "Root Inclusion Request" Case

After you have provided information to the CCADB about your CA organization and root certificates, you may use a "Root Inclusion Request" case to request that your root certificate(s) be included in Mozilla's root store, update trust bit settings, and/or enable EV treatment.

1. Create a "Root Inclusion Request" Case in the CCADB
   • Detailed Instructions: Create a Root Inclusion Request
2. Fill in all of the fields in the MOZILLA tab
3. Click on the "Submit to Root Store" button.

Important:

• In the MOZILLA tab, click on the "Print View" button to see the data that will be shared publicly about your request.
• Click on the "Get URLs" button (which may be in the button overflow – upside down triangle) and copy the line that begins with “Mozilla Root Inclusion Case Information:” into a Comment in your Bugzilla Bug. The line to copy and paste into the Bugzilla Bug looks like:
  • Mozilla Root Inclusion Case Information: https://ccadb.my.salesforce-sites.com/mozilla/PrintViewForCase?CaseNumber=00000341
• Whenever you update data in your Root Inclusion Case in the CCADB, be sure to add a comment to your Bugzilla Bug to let folks know to re-check the information.

CA Primary Point of Contact (POC)

Each CA organization in the CCADB must provide the contact information for at least one person filling the role of Primary Point of Contact (POC), as described in section 2 of the CCADB Policy.

Provide or update POC information

• Create an "Add/Update Contacts" case.
  • Detailed Instructions: Add/Update Contacts
• Provide the updates in the CONTACTS tab.
• Click on the "Submit to Root Store" button.

Responsibilities of a Primary POC

• Provide annual updates of CP/CPS documents, audit statements, and test websites.
• Respond to CA Communications
• Input and maintain the CA’s data in the CCADB.
• Inform Mozilla when there is a change in the organization, ownership, CA policies, or in the POCs that Mozilla should be aware of, as per
  • Section 2 of the CCADB Policy, and
  • Section 8 of the Mozilla Root Store Policy.
• Make sure the "CA Email Alias" field on the CA Owner page is correct.
  • An email alias is being requested so that more than one person in your organization will receive notifications in case the primary contact is out of the office or leaves the organization.
  • The CA Email Alias is updated via an "Add/Update Root Request" case.

Authority

If the CA uses a contractor as a POC, then someone at the CA must also be a POC for the CA Owner record in the CCADB, and the POC from the CA must be CC’d on the root inclusion Bugzilla bug.

• An individual within the CA must also get a Bugzilla account and comment in the bug to say that they will be a POC for the CA, and that the contractor has indeed been hired by the CA to act as one of the POCs.

To ensure that the POC(s) has the authority to perform the tasks listed above, a representative of Mozilla may do the following.

1. Use the CA’s website to contact a person at the CA to confirm that the Primary POCs that have been provided do indeed have the authority to perform the responsibilities listed above on behalf of the CA.
2. Use the CA’s website, to confirm that the domain in the email address of at least one of the Primary POCs is owned by the CA (e.g. @CAname.com).
3. If a contractor is also used as a Primary POC, then contact the Primary POC that was previously verified to confirm that the CA has indeed enlisted the help of the contractor.