All,
This email commences a six-week public discussion of D-Trust’s request to include the following certificates as publicly trusted root certificates in one or more CCADB Root Store Member’s program. This discussion period is scheduled to close on October 24, 2024.
The purpose of this public discussion process is to promote openness and transparency. However, each Root Store makes its inclusion decisions independently, on its own timelines, and based on its own inclusion criteria. Successful completion of this public discussion process does not guarantee any favorable action by any root store.
Anyone with concerns or questions is urged to raise them on this CCADB Public list by replying directly in this discussion thread. Likewise, a representative of the applicant must promptly respond directly in the discussion thread to all questions that are posted.
CCADB Case Number: 00001362 and 00001363
Organization Background Information (listed in the CCADB):
CA Owner Name: D-Trust
Website: https://www.d-trust.net/en
Address: Kommandantenstr. 15, Berlin, 10969, Germany
Problem Reporting Mechanisms: https://www.d-trust.net/en/support/reporting-certificate-problem
Organization Type: Government Agency
Repository URL: https://www.bundesdruckerei.de/en/Repository
Certificates Requesting Inclusion:
D-TRUST EV Root CA 2 2023:
Certificate download links: CA Repository / crt.sh
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
Client Authentication 1.3.6.1.5.5.7.3.2
Test websites:
Replacement notice: D-Trust has communicated intent to use this applicant root to replace D-TRUST Root Class 3 CA 2 EV 2009 in some root stores, with the replacement taking place approximately on September 1, 2026.
D-TRUST BR Root CA 2 2023:
Certificate download links: CA Repository / crt.sh
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
Client Authentication 1.3.6.1.5.5.7.3.2
Test websites:
Replacement notice: D-Trust has communicated intent to use this applicant root to replace D-TRUST Root Class 3 CA 2 2009 in some root stores, with the replacement taking place approximately on September 1, 2026.
Existing Publicly Trusted Root CAs from D-Trust:
D-TRUST BR Root CA 1 2020:
Certificate download links: (CA Repository /crt.sh)
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
Client Authentication 1.3.6.1.5.5.7.3.2
Certificate corpus: here (Censys login required)
Included in: Google Chrome, Mozilla
D-Trust SBR Root CA 1 2022:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
Client Authentication 1.3.6.1.5.5.7.3.2;
Document Signing AATL 1.2.840.113583.1.1.5;
Document Signing MS 1.3.6.1.4.1.311.10.3.12
Certificate corpus: N/A
Included in: Mozilla
D-Trust SBR Root CA 2 2022:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
Client Authentication 1.3.6.1.5.5.7.3.2;
Document Signing AATL 1.2.840.113583.1.1.5;
Document Signing MS 1.3.6.1.4.1.311.10.3.12
Certificate corpus: N/A
Included in: Mozilla
D-TRUST EV Root CA 1 2020:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
Client Authentication 1.3.6.1.5.5.7.3.2
Certificate corpus: here (Censys login required)
Included in: Google Chrome, Mozilla
D-TRUST Root CA 3 2013:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
Client Authentication 1.3.6.1.5.5.7.3.2;
Document Signing AATL 1.2.840.113583.1.1.5;
Document Signing MS 1.3.6.1.4.1.311.10.3.12
Certificate corpus: N/A
Included in: Apple, Microsoft, Mozilla
D-TRUST Root Class 3 CA 2 2009:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1;
Client Authentication 1.3.6.1.5.5.7.3.2
Certificate corpus: here (Censys login required)
Included in: Apple, Google Chrome, Microsoft, Mozilla
D-TRUST Root Class 3 CA 2 EV 2009:
Certificate download links: (CA Repository / crt.sh)
Use cases served/EKUs:
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1;
Client Authentication 1.3.6.1.5.5.7.3.2
Certificate corpus: here (Censys login required)
Included in: Apple, Google Chrome, Microsoft, Mozilla
Relevant Policy and Practices Documentation:
CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
TSPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
Most Recent Self-Assessment:
https://bugzilla.mozilla.org/attachment.cgi?id=9361619 (completed 10/30/2023)
Audit Statements:
Auditor: TÜViT - TÜV Informationstechnik GmbH
Audit Criteria: ETSI
Recent Audit Statement(s):
Key Generation (May 9, 2023)
Standard Audit (Period: October 8, 2022 to October 7, 2023)
TLS BR Audit (Period: October 8, 2022 to October 7, 2023)
TLS EVG Audit (Period: October 8, 2022 to October 7, 2023)
Incident Summary (Bugzilla incidents from previous 24 months):
1682270: D-TRUST: Private Key Disclosed by Customer as Part of CSR
1691117: D-TRUST: Certificate with RSA key where modulus is not divisible by 8
1756122: D-TRUST: Wrong key usage (Key Agreement)
1793440: D-TRUST: CRL not DER-encoded
1861069: D-Trust: Issuance of 15 DV certificates containing ‘serialNumber’ field within subject
1862082: D-Trust: Delay beyond 5 days in revoking misissued certificate
1879529: D-Trust: "unknown" OCSP response for issued certificates
1884714: D-Trust: LDAP-URL in Subscriber Certificate Authority Information Access field
1891225: D-Trust: Issuance of 15 certificates with incorrect subject attribute order
1893610: D-Trust: Notice to affected Subscriber and person filing CPR not sent within 24 hours
1896190: D-Trust: Issuance of an EV certificate containing a mixup of the Subject's postalCode and localityName
1913310: D-Trust: CRL-Entries without required CRL Reason Code
Thank you,
Ryan, on behalf of the CCADB Steering Committee
--
You received this message because you are subscribed to the Google Groups "CCADB Public" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public+un...@ccadb.org.
To view this discussion on the web visit https://groups.google.com/a/ccadb.org/d/msgid/public/CADEW5O-BWJreka1U2n5Xk20aEcYK8cp8-yp1jTFOfTT-ef9L1g%40mail.gmail.com.
Dear Amir,
Thank you for your comment. We will review this and come back to you by the end of next week.
Greetings,
Leyla
Von: 'Amir Omidi' via CCADB Public <pub...@ccadb.org>
Gesendet: Donnerstag, 12. September 2024 16:17
An: Ryan Dickson <ryand...@google.com>
Cc: public <pub...@ccadb.org>
Betreff: Re: Public Discussion of D-Trust TLS CA Inclusion Request
The CPR process (
https://www.d-trust.net/en/support/reporting-certificate-problem) seems quite annoying. Downloading and editing a PDF just to send a CPR is a bit too much.
On Thu, Sep 12, 2024 at 09:15 'Ryan Dickson' via CCADB Public <pub...@ccadb.org> wrote:
All,
This email commences a six-week public discussion of D-Trust’s request to include the following certificates as publicly trusted root certificates in one or more CCADB Root Store Member’s program. This discussion period is scheduled to close on October 24, 2024.
The purpose of this public discussion process is to promote openness and transparency. However, each Root Store makes its inclusion decisions independently, on its own timelines, and based on its own inclusion criteria. Successful completion of this public discussion process does not guarantee any favorable action by any root store.
Anyone with concerns or questions is urged to raise them on this CCADB Public list by replying directly in this discussion thread. Likewise, a representative of the applicant must promptly respond directly in the discussion thread to all questions that are posted.
CCADB Case Number: 00001362 and 00001363
Organization Background Information (listed in the CCADB):
· CA Owner Name: D-Trust
· Website: https://www.d-trust.net/en
· Address: Kommandantenstr. 15, Berlin, 10969, Germany
· Problem Reporting Mechanisms: https://www.d-trust.net/en/support/reporting-certificate-problem
· Organization Type: Government Agency
· Repository URL: https://www.bundesdruckerei.de/en/Repository
Certificates Requesting Inclusion:
1. D-TRUST EV Root CA 2 2023:
o Certificate download links: CA Repository / crt.sh
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Test websites:
o Replacement notice: D-Trust has communicated intent to use this applicant root to replace D-TRUST Root Class 3 CA 2 EV 2009 in some root stores, with the replacement taking place approximately on September 1, 2026.
2. D-TRUST BR Root CA 2 2023:
o Certificate download links: CA Repository / crt.sh
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Test websites:
o Replacement notice: D-Trust has communicated intent to use this applicant root to replace D-TRUST Root Class 3 CA 2 2009 in some root stores, with the replacement taking place approximately on September 1, 2026.
Existing Publicly Trusted Root CAs from D-Trust:
1. D-TRUST BR Root CA 1 2020:
o Certificate download links: (CA Repository /crt.sh)
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Certificate corpus: here (Censys login required)
o Included in: Google Chrome, Mozilla
2. D-Trust SBR Root CA 1 2022:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
§ Client Authentication 1.3.6.1.5.5.7.3.2;
§ Document Signing AATL 1.2.840.113583.1.1.5;
§ Document Signing MS 1.3.6.1.4.1.311.10.3.12
o Certificate corpus: N/A
o Included in: Mozilla
3. D-Trust SBR Root CA 2 2022:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
§ Client Authentication 1.3.6.1.5.5.7.3.2;
§ Document Signing AATL 1.2.840.113583.1.1.5;
§ Document Signing MS 1.3.6.1.4.1.311.10.3.12
o Certificate corpus: N/A
o Included in: Mozilla
4. D-TRUST EV Root CA 1 2020:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Certificate corpus: here (Censys login required)
o Included in: Google Chrome, Mozilla
5. D-TRUST Root CA 3 2013:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4;
§ Client Authentication 1.3.6.1.5.5.7.3.2;
§ Document Signing AATL 1.2.840.113583.1.1.5;
§ Document Signing MS 1.3.6.1.4.1.311.10.3.12
o Certificate corpus: N/A
o Included in: Apple, Microsoft, Mozilla
6. D-TRUST Root Class 3 CA 2 2009:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1;
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Certificate corpus: here (Censys login required)
o Included in: Apple, Google Chrome, Microsoft, Mozilla
7. D-TRUST Root Class 3 CA 2 EV 2009:
o Certificate download links: (CA Repository / crt.sh)
o Use cases served/EKUs:
§ Server Authentication (TLS) 1.3.6.1.5.5.7.3.1;
§ Client Authentication 1.3.6.1.5.5.7.3.2
o Certificate corpus: here (Censys login required)
o Included in: Apple, Google Chrome, Microsoft, Mozilla
Relevant Policy and Practices Documentation:
· CP: http://www.d-trust.net/internet/files/D-TRUST_CP.pdf
· CPS: http://www.d-trust.net/internet/files/D-TRUST_CSM_PKI_CPS.pdf
· TSPS: https://www.d-trust.net/internet/files/D-TRUST_TSPS.pdf
Most Recent Self-Assessment:
· https://bugzilla.mozilla.org/attachment.cgi?id=9361619 (completed 10/30/2023)
Audit Statements:
· Auditor: TÜViT - TÜV Informationstechnik GmbH
· Audit Criteria: ETSI
· Recent Audit Statement(s):
o Key Generation (May 9, 2023)
o Standard Audit (Period: October 8, 2022 to October 7, 2023)
o TLS BR Audit (Period: October 8, 2022 to October 7, 2023)
o TLS EVG Audit (Period: October 8, 2022 to October 7, 2023)
Incident Summary (Bugzilla incidents from previous 24 months):
· 1682270: D-TRUST: Private Key Disclosed by Customer as Part of CSR
· 1691117: D-TRUST: Certificate with RSA key where modulus is not divisible by 8
· 1756122: D-TRUST: Wrong key usage (Key Agreement)
· 1793440: D-TRUST: CRL not DER-encoded
· 1861069: D-Trust: Issuance of 15 DV certificates containing ‘serialNumber’ field within subject
· 1862082: D-Trust: Delay beyond 5 days in revoking misissued certificate
· 1879529: D-Trust: "unknown" OCSP response for issued certificates
· 1884714: D-Trust: LDAP-URL in Subscriber Certificate Authority Information Access field
· 1891225: D-Trust: Issuance of 15 certificates with incorrect subject attribute order
· 1893610: D-Trust: Notice to affected Subscriber and person filing CPR not sent within 24 hours
· 1896190: D-Trust: Issuance of an EV certificate containing a mixup of the Subject's postalCode and localityName
· 1913310: D-Trust: CRL-Entries without required CRL Reason Code
Thank you,
Ryan, on behalf of the CCADB Steering Committee
--
You received this message because you are subscribed to the Google Groups "CCADB Public" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public+un...@ccadb.org.
To view this discussion on the web visit https://groups.google.com/a/ccadb.org/d/msgid/public/CADEW5O-BWJreka1U2n5Xk20aEcYK8cp8-yp1jTFOfTT-ef9L1g%40mail.gmail.com.
--
You received this message because you are subscribed to the Google Groups "CCADB Public" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
public+un...@ccadb.org.
To view this discussion on the web visit https://groups.google.com/a/ccadb.org/d/msgid/public/CAOG%3DJUJEGeUJ-aooti63Tik-33Ef6%2BesoFtZkR_nHW-aRL-PSg%40mail.gmail.com.
Hi Amir,
Leyla is on sick leave. Therefore I’ll take over for her.
We understand that the current CPR process is not convenient but it fulfills all requirements and worked so far as needed.
We are in the process of creating an improved version of the CPR process which will be introduced as a web form by the end of the year.
Thanks,
Enrico
To view this discussion on the web visit https://groups.google.com/a/ccadb.org/d/msgid/public/BE1P281MB219568DD6B4D7D2E95B8451086732%40BE1P281MB2195.DEUP281.PROD.OUTLOOK.COM.