ACCV (Autoritat de Certificacio de la Comunitat Valenciana) is a CA operated by the government of the Valencia region of Spain.

Seguridad y Sistemas de Informacion S.L. Informe de Auditoria Independiente

CRL http://ocsp.pki.gva.es/ DV, IV Declaracion de Practicas de Certificacion (CPS) de la ACCV, v1.7 in Spanish Certification policies and practices for the different types of certs (Spanish) http://bugzilla.mozilla.org/show_bug.cgi?id=274100

Korea Information Security Agency (KISA) is the Electronic Signature Authorization Management Center for South Korea. The Korean Certification Authority Central (KCAC) of KISA issues certificates to six (6) intermediate CAs ("licensed CAs" or LCAs), which then issue end entity certificates to Korean citizens, businesses, and other organizations.

Ministry of Information and Communication, Republic of Korea Public statement by MIC re KISA/KCAC audit

Certificates are issued from this root only to KISA's 6 LCAs (Licensed CAs), not directly to end entities. Note that this root is apparently being phased out in favor of the KISA RootCA 1.

CRL DV and IV CPS 1.1 (English) CPS 1.3 (Korean) Certificate issuing procedure (Korean) Web Server Security, Code-Signing, Secure E-mail Certificates Issuance Administration Guideline (English) https://bugzilla.mozilla.org/show_bug.cgi?id=335197

Certificates are issued from this root only to KISA's 6 LCAs (Licensed CAs), not directly to end entities. Note that this root CA is replacing CertRSA01.

CRL DV and IV CPS 1.1 (English) CPS 1.3 (Korean) Certificate issuing procedure Web Server Security, Code-Signing, Secure E-mail Certificates Issuance Administration Guideline (English) https://bugzilla.mozilla.org/show_bug.cgi?id=335197

Certificates are issued from this root only to KISA's 6 LCAs (Licensed CAs), not directly to end entities.

Deutscher Sparkassen Verlag GmbH is the world's largest smartcard provider and the central certification service provider for all German savings banks. This CA exists to enable up to 40 million German customers (end-users) to use their banking card as a certificate based signature, encryption and authentication device.

TÜV-IT ETSI TS 101.456 Certificate TÜV-IT ETSI TS 102.042 Certificate

This root will provide all customers of the German Savings Bank Financial Group with client certificates for their signature-enabled debit cards (smartcards).

CRL http://ocsp-q.s-trust.de IV Certification Practice Statement for the S-TRUST Network https://bugzilla.mozilla.org/show_bug.cgi?id=370627 Not approved for inclusion.

This root will provide all customers of the German Savings Bank Financial Group with client certificates for their signature-enabled debit cards (smartcards).

CRL http://ocsp-q.s-trust.de IV Certification Practice Statement for the S-TRUST Network https://bugzilla.mozilla.org/show_bug.cgi?id=370627 Not approved for inclusion.

This root will provide all customers of the German Savings Bank Financial Group with client certificates for their signature-enabled debit cards (smartcards).

CRL http://ocsp-q.s-trust.de IV Certification Practice Statement for the S-TRUST Network https://bugzilla.mozilla.org/show_bug.cgi?id=370627 Not approved for inclusion.

The Telekom-Control Commission is the Austrian supervisory authority for electronic signatures. Its responsibility includes supervision of all certification service providers established in Austria. For every CA key used by an Austrian certification service provider, the TKK issues a certificate to the certification service provider. Based on these certificates, all certificates issued by supervised Austrian certification service providers can be verified. There are five subordinate CAs, each of which issues certificates for a different purpose.

Secure Information Technology Center - Austria Conformity Assessment Statement

The TKK issues certificates to certification service providers who are supervised according to the Austrian Electronic Signatures Act. The corresponding private keys of certification service providers are used for issuing certificates to end entities (signatories).

CRL OV Certificate Policy Certificate Practice Statement https://bugzilla.mozilla.org/show_bug.cgi?id=373174 CRL doesn't work in Firefox - bug 133191.

VeriSign is a major commercial CA with worldwide operations and customer base.

KPMG Audit Report and Management's Assertions

This CA will be used to sign certificates for SSL-enabled servers, and may in the future be used to sign certificates for digitally-signed executable code objects. VeriSign is not yet actively issuing certificates from this root, so they have not yet published a CRL. All subordinated CAs for this root will be internally operated.

CRL OV VeriSign Certification Practice Statement VeriSign Trust Network Certificate Policies https://bugzilla.mozilla.org/show_bug.cgi?id=409235

This CA will be used to sign certificates for SSL-enabled servers, and may in the future be used to sign certificates for digitally-signed executable code objects.

CRL OV VeriSign Certification Practice Statement VeriSign Trust Network Certificate Policies https://bugzilla.mozilla.org/show_bug.cgi?id=484901

This root CA (also known as PCA1-G1-SHA1) has Signature Algorithm SHA-1 With RSA Encryption. This root will supersede the PCA1-G1 root that is already included in NSS, which has Signature Algorithm MD2 With RSA Encryption.

CRL http://evintl-ocsp.verisign.com/ DV VeriSign Certification Practice Statement VeriSign Trust Network Certificate Policies https://bugzilla.mozilla.org/show_bug.cgi?id=490895

This root CA (also known as PCA2-G1-SHA1) has Signature Algorithm SHA-1 With RSA Encryption. This root will supersede the PCA2-G1 root that is already included in NSS, which has Signature Algorithm MD2 With RSA Encryption.

CRL http://evintl-ocsp.verisign.com/ IV/OV VeriSign Certification Practice Statement VeriSign Trust Network Certificate Policies https://bugzilla.mozilla.org/show_bug.cgi?id=490895

This root CA (also known as PCA3-G1-SHA1) has Signature Algorithm SHA-1 With RSA Encryption. This root will supersede the PCA3-G1 root that is already included in NSS, which has Signature Algorithm MD2 With RSA Encryption. The PCA3-G1 roots participate in the cross-signing scheme by which EV certs issued under the VeriSign Class 3 Public Primary Certification Authority - G5 hierarchy may chain up to existing VeriSign roots.

CRL http://evintl-ocsp.verisign.com/ OV, EV (policy OID 2.16.840.1.113733.1.7.23.6) VeriSign Certification Practice Statement VeriSign Trust Network Certificate Policies https://bugzilla.mozilla.org/show_bug.cgi?id=490895

a.trust is an accredited Trust Center in Austria issuing smartcard-based qualified certificates for Austrian citizens, to be used in eGovernment, etc.

The intermediate CAs below this CA issue only qualified smartCard-based certificates to a natural person after a face-to-face identification.

CRL http://ocsp.a-trust.at/ocsp IV Full list of CPs Full list of CPSes https://bugzilla.mozilla.org/show_bug.cgi?id=373746

The intermediate CAs below this CA issue qualified smartCard-based certificates to a natural person after a face-to-face identification, smartCard-based certificates to a natural person after a face-to-face identification (eg.: email), and server certificates (eg. SSL) after domain-verification.

CRL http://ocsp.a-trust.at/ocsp DV, IV Full list of CPs Full list of CPSes https://bugzilla.mozilla.org/show_bug.cgi?id=373746 Presumably the sub-CA for which they have given a CP/CPS is only signed by one of these four...

The intermediate CAs below this CA issue smartCard-based certificates to a natural person after a face-to-face identification (eg.: email), software certificates (pKCS#12), and server certificates (eg. SSL) after domain-verification

CRL http://ocsp.a-trust.at/ocsp DV, IV Full list of CPs Full list of CPSes https://bugzilla.mozilla.org/show_bug.cgi?id=373746

ARGE DATEN, the Austrian Society for Data Protection is a non-profit non-governmental organisation. It is the Austrian market leader in issuing certificates for eBilling. It operates subordinate CAs for eBilling, SSL Server Certificates, SSL Client Certificates, and members of governmental institutions.

This root certificate issues both end-user certificates and CA certificates. It is the current root certificate of ARGE DATEN.

CRL http://ocsp.a-cert.at IV A-CERT Certificate Policy v1.5 https://bugzilla.mozilla.org/show_bug.cgi?id=348987

This root certificate will not directly issue end-user certificates. It is used to issue the subordinate CA certificates which in turn issue the end-user certificates. This certificate is the successor to the A-CERT ADVANCED root certificate.

CRL http://ocsp.a-cert.at IV GLOBALTRUST Certificate Policy v1.2 https://bugzilla.mozilla.org/show_bug.cgi?id=348987

Trustis is a commercial CA operating primarily in the UK and Europe.

KPMG Audit Report and Management Assertions tScheme tScheme Grant of Approval

CRL IV Trustis FPS Root CP v1.04 PKI Disclosure Statement v1.04 Trustis CPS v1.1 https://bugzilla.mozilla.org/show_bug.cgi?id=324126

Kamu Sertifikasyon Merkezi is the one government CA in Turkey that has authorization to issue certificates to government entities. They are also authorised to issue to commercial companies.

Turkish Information and Communications Technologies Authority (ICTA) ICTA statement of ETSI compliance

CRL http://ocsp.kamusm.gov.tr DV, IV CP CPS https://bugzilla.mozilla.org/show_bug.cgi?id=381974 https://bugzilla.mozilla.org/show_bug.cgi?id=499705

Izenpe is owned by the government of the Basque country, Spain.

BSI Management Systems ETSI Certificate

This is the original root, which is still needed. This root has four internally-operated subordinate CAs. There are two sub-CAs for Qualified certificates, one for Public Administration, and one for Citizens and Entities. There are also two sub-CAs for non-Qualified certificates, one for Public Administration and one for Citizens and Entities, which issue SSL Server, Email, and Code Signing certs.

CRL http://ocsp.izenpe.com:8094 OV CA Hierarchy Links to CPS in Spanish, Basque, and English CPS in English Declaration of Practices for each type of certificate (Spanish and Basque) https://bugzilla.mozilla.org/show_bug.cgi?id=361957

This is the new root, signed with SHA1. This root has five internally-operated subordinate CAs. One sub-CA issues EV SSL certs. Two of the sub-CAs are for Qualified certificates, one for Public Administration, and one for Citizens and Entities. There are also two sub-CAs for non-Qualified certificates, one for Public Administration and one for Citizens and Entities, which issue SSL Server, Email, and Code Signing certs.

CRL http://ocsp.izenpe.com:8094 OV, EV (Policy OID 1.3.6.1.4.1.14777.6.1.1) CA Hierarchy Links to CPS in Spanish, Basque, and English CPS in English Declaration of Practices for each type of certificate (Spanish and Basque) https://bugzilla.mozilla.org/show_bug.cgi?id=361957

This is the new root, signed with SHA-256. This root has five internally-operated subordinate CAs. One sub-CA issues EV SSL certs. Two of the sub-CAs are for Qualified certificates, one for Public Administration, and one for Citizens and Entities. There are also two sub-CAs for non-Qualified certificates, one for Public Administration and one for Citizens and Entities, which issue SSL Server, Email, and Code Signing certs.

TC TrustCenter GmbH is a commercial company based in Germany, with customers in all major regions of the world. TC TrustCenter offers a variety of products and services including SSL Server certificates and Email certificates.

TÜV-IT Germany ETSI TS 102.042 LCP Certificate

This root has four internally-operated subordinate CAs which issue certificates for email and SSL client authentication. This root also has an externally-operated sub-CA which is used to issue certificates to company internal email users. There are many customers who are using certificates chained to this root for secure email with Thunderbird.

CRL http://ocsp.tcclass1.trustcenter.de/ Hierarchy Diagram TC TrustCenter GmbH Certification Practice Statement (CPS) TC TrustCenter Certificate Policy Definitions (CPD) TC TrustCenter CA Certificates https://bugzilla.mozilla.org/show_bug.cgi?id=392024 This root will not be approved for inclusion.

This EV Root is being used to issue all types of certificates, e.g. Email Security,SSL-Client-Authentication, SSL-Server, CodeSigning.

CRL http://ocsp.tcclass4-ii.trustcenter.de EV (policy OID 1.2.276.0.44.1.1.1.4) Hierarchy Diagram TC TrustCenter GmbH Certification Practice Statement (CPS) TC TrustCenter Certificate Policy Definitions (CPD) TC TrustCenter CA Certificates https://bugzilla.mozilla.org/show_bug.cgi?id=436467

This Root is being used to issue all types of certificates, e.g. Email Security, SSL-Client-Authentication, SSL-Server, CodeSigning.

CRL http://ocsp.tcuniversal-ii.trustcenter.de OV Hierarchy Diagram TC TrustCenter GmbH Certification Practice Statement (CPS) TC TrustCenter Certificate Policy Definitions (CPD) TC TrustCenter CA Certificates https://bugzilla.mozilla.org/show_bug.cgi?id=392024 This root was postponed. A new bug will need to be created when ready to submit an inclusion request for this root.

QuoVadis is a commercial CA, based in Bermuda and operating globally. QuoVadis is a Qualified Certification Services Provider in Switzerland.

Ernst & Young (Technology and Security Risk Services) Audit Report and Management's Assertions KPMG Swiss Accreditation Service statement Ernst & Young CA-supplied auditor's letter re WebTrust EV audit

This root will be used for SSL/device certificates, including standard "organisation validated" certificates as well as EV certificates. The associated EV policy OID is 1.3.6.1.4.1.8024.0.2.100.1.2.

CRL http://ocsp.quovadisglobal.com/ OV, EV QuoVadis Root CA2 CP/CPS v1.8 https://bugzilla.mozilla.org/show_bug.cgi?id=403665 https://bugzilla.mozilla.org/show_bug.cgi?id=418701 Note that this root CA certificate is already included in the Mozilla list (per bug 365281). The present request is to enable this CA certificate for EV.

DigiCert is a US-based commercial CA with headquarters in Lindon, UT. DigiCert provides digital certification and identity assurance services internationally to a variety of sectors including business, education, and government.

KPMG Audit Report and Management's Assertions KPMG Report in relation to the WebTrust for Certification Authorities Extended Validation Criteria

CRL http://ocsp.digicert.com OV, EV (policy OID 2.16.840.1.114412.2.1) DigiCert Certificate Policy and Certification Practice Statement (CP and CPS for OV), v3.0.6 DigiCert Certification Practice Statement for Extended Validation Certificates (CPS for EV), v1.0.1 https://bugzilla.mozilla.org/show_bug.cgi?id=403644 https://bugzilla.mozilla.org/show_bug.cgi?id=416827 Note that this root CA certificate is already included in the Mozilla list. The present request is to enable this CA certificate for EV.

Comodo CA Ltd is a commercial CA based in the UK and serving customers worldwide. Comodo has eleven root CA certs already included in Mozilla, all of which it would like upgraded for EV use, and one additional EV root requested for inclusion. There are altogether 124 subordinate CAs signed by the root CAs listed below. Some of them exist to differentiate between different Comodo brands or products and some are used to re-brand products for its partners. In each case Comodo retains the private key for the subordinate CA within its infrastructure.

KPMG Audit Report and Management's Assertions KPMG Report in relation to the WebTrust for Certification Authorities Extended Validation Criteria