The public comment period for this request is now over. This request has been evaluated as per Mozilla’s CA Certificate Inclusion Policy at
https://www.mozilla.org/about/governance/policies/security- group/certs/policy/inclusion/ Here follows a summary of the assessment. If anyone sees any factual errors, please point them out. Inclusion Policy Section 4 [Technical]. I am not aware of instances where Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) has knowingly issued certificates for fraudulent use. If anyone knows of any such issues or instances, please note them in this bug. Inclusion Policy Section 6 [Relevance and Policy]. FNMT appears to provide a service relevant to Mozilla users. It provides services to Spain as a national CA. Root Certificate Name: AC RAIZ FNMT-RCM O From Issuer Field: FNMT-RCM Trust Bits: Websites EV Policy OID(s): Not EV Root Certificate Download URL: http://www.cert.fnmt.es/certs/ACRAIZFNMTRCM.crt CA Document Repository: https://www.sede.fnmt.gob.es/normativa/declaracion-de-practicas-de-certificacion CP: https://www.sede.fnmt.gob.es/documents/11614/67070/dpc_componentes_english.pdf/ CPS: https://www.sede.fnmt.gob.es/documents/11614/137578/dpc_english.pdf/ Updated CPS attached to bug February 2015: https://bug435736.bugzilla.mozilla.org/attachment.cgi?id=8565442 Certificate Revocation OCSP URL(s): http://ocspape.cert.fnmt.es/ocspape/OcspResponder http://ocspap.cert.fnmt.es/ocspap/OcspResponder Inclusion Policy Section 7 [Validation]. FNMT appears to meet the minimum requirements for subscriber verification, as follows: * SSL Verification Procedures: According to section 6.1.3 of dpc_componentes_english.pdf, if the Certificate is associated with one or more Internet domains, the Registry Office will check, on the authorized domain registrars' databases, that the title holder of the domain and the Certificate Subscriber match, and will keep proof of the inquiry. * EV SSL Verification Procedures: Not requesting EV treatment * Email Verification Procedures: Not requesting Email trust bit * Code Signing Subscriber Verification Procedure: Not requesting Code Signing trust bit Inclusion Policy Sections 11-14 [Audit]. See Comment #165 for details about FNMT's audits. Inclusion Policy Section 18 [Certificate Hierarchy] There are internally-operated subCAs in this CA hierarchy, and there is no plan to allow for externally-operated subCAs. The internally-operated subCAs are as follows: + AC Administración Pública - Issues: SSL certs, QCP certs - Audits: WebTrust for CAs, WebTrust SSL BRs, ETSI 101 456 + AC Componentes Informáticos - Issues: SSL certs - Audits: WebTrust for CAs, WebTrust SSL BRs + AC FNMT Usuarios - Issues: issues QCP certs, not restricted by EKU extension - Audits: (ETSI 101 456 or WebTrust for CAS) and audit of non-existence of SSL certs + ISA CA - revoked, being added to OneCRL via Bug #1263949 + AC APE - revoked, being added to OneCRL via Bug #1263949 Based on this assessment I intend to approve this request from FNMT to include the “AC RAIZ FNMT-RCM” root certificate and enable the Websites trust bit. -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to thunderbird in Ubuntu. https://bugs.launchpad.net/bugs/1271513 Title: www.cert.fnmt.es certificates are not included in Mozilla products Status in Mozilla Firefox: Fix Released Status in Mozilla Thunderbird: Fix Released Status in firefox package in Ubuntu: Fix Released Status in thunderbird package in Ubuntu: Fix Released Bug description: Please add <www.cert.fnmt.es> (National Coin and Ding Factory of Spain) as a valid certification authority in the default Firefox installation. ProblemType: Bug DistroRelease: Ubuntu 13.10 Package: firefox 26.0+build2-0ubuntu0.13.10.2 ProcVersionSignature: Ubuntu 3.11.0-14.21-generic 3.11.7 Uname: Linux 3.11.0-14-generic x86_64 AddonCompatCheckDisabled: False ApportVersion: 2.12.5-0ubuntu2.2 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC2: es20490446e 2130 F.... pulseaudio /dev/snd/controlC1: es20490446e 2130 F.... pulseaudio /dev/snd/controlC0: es20490446e 2130 F.... pulseaudio BuildID: 20131206145143 Channel: Unavailable Date: Wed Jan 22 12:49:53 2014 Extensions: extensions.sqlite corrupt or missing ForcedLayersAccel: False IfupdownConfig: # interfaces(5) file used by ifup(8) and ifdown(8) auto lo iface lo inet loopback IncompatibleExtensions: Unavailable (corrupt or non-existant compatibility.ini or extensions.sqlite) InstallationDate: Installed on 2013-05-21 (245 days ago) InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424) IpRoute: default via 192.168.2.1 dev eth0 proto static 192.168.2.0/24 dev eth0 proto kernel scope link src 192.168.2.117 metric 1 IwConfig: eth0 no wireless extensions. lo no wireless extensions. Locales: extensions.sqlite corrupt or missing MarkForUpload: True PrefSources: prefs.js Profiles: Profile0 (Default) - LastVersion=26.0/20131206145143 (In use) RelatedPackageVersions: google-talkplugin 4.9.1.0-1 icedtea-7-plugin 1.4-3ubuntu2 totem-mozilla 3.8.2-0ubuntu1 rhythmbox-mozilla 2.99.1-0ubuntu1 RfKill: RunningIncompatibleAddons: False SourcePackage: firefox Themes: extensions.sqlite corrupt or missing UpgradeStatus: Upgraded to saucy on 2013-10-18 (96 days ago) WifiSyslog: dmi.bios.date: 02/18/2008 dmi.bios.vendor: Phoenix Technologies, LTD dmi.bios.version: 6.00 PG dmi.board.name: MS-7358 dmi.board.vendor: MICRO-STAR INTERNATIONAL CO., LTD dmi.board.version: Fab D dmi.chassis.type: 3 dmi.chassis.vendor: OEM dmi.chassis.version: OEM dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr6.00PG:bd02/18/2008:svnMEDIONPC:pnMS-7358:pvrOEM:rvnMICRO-STARINTERNATIONALCO.,LTD:rnMS-7358:rvrFabD:cvnOEM:ct3:cvrOEM: dmi.product.name: MS-7358 dmi.product.version: OEM dmi.sys.vendor: MEDIONPC To manage notifications about this bug go to: https://bugs.launchpad.net/firefox/+bug/1271513/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
