.

CAAction #1
Check external SubCAs
Action #2
Update CP/CPS if external subCAs allowed
Action #3
Confirm all issued EV SSL Certs meet EV technical requirements
Action #4
Confirm no remaining end-entity certs with MD5 and small key sizes
Action #5
Baseline Requirements Compliance
Notes

.

A-TrustAN/AConfirmedConfirmedCompliant

.

AffirmTrustAN/AConfirmedConfirmedIP

.

AOLAN/AN/AConfirmedIP

.

AS Sertifitseerimiskeskuse (SK)AN/AN/AConfirmedIP

.

Autoridad de Certificacion FirmaprofesionalBCP/CPS does not allow MITM usageN/AConfirmedCompliant

.

BuypassAN/AConfirmedConfirmedIP

.

CA Disig a.s. AN/AN/AConfirmedIP

.

CamerfirmaAN/AConfirmedConfirmedIP

.

CATCertACP/CPS does not allow MITM usageConfirmedConfirmedIP

.

Certicámara S.A.AN/AN/A?N/A** No longer issuing SSL certs under this root.

.

Certigna (Dhimyotis)AN/AN/AConfirmedIP

.

CertinomisAN/AN/AConfirmedIP

.

certSIGNAN/AN/AConfirmedIP

.

China Internet Network Information Center (CNNIC)AN/AConfirmedConfirmedIP

.

Chunghwa Telecom CorporationAN/AN/AConfirmedIP

.

Comodo (AddTrust, Comodo, USERTRUST)EIPConfirmedConfirmedIP

.

ComSign (Comda)AN/AN/AConfirmedIP

.

DanID (TDC)AN/AN/AConfirmedIP

.

Deutsche Telekom/T-SystemsBCP/CPS does not allow MITM usageN/AConfirmedIP

.

Deutscher Sparkassen Verlag GmbH (S-TRUST, DSV)AN/AN/AConfirmedN/A**SSL trust bit not enabled

.

DigiCertAN/AConfirmedConfirmedIP

.

e-Guven Elektronik Bilgi Guvenligi A.S. AN/AN/AConfirmedCompliant

.

e-tugraAN/AN/AConfirmedIP

.

EDICOMAN/AN/AConfirmedIP

.

EntrustB, E*CP/CPS does not
allow MITM usage
ConfirmedConfirmed**IP*The 'E' subCAs are all directly included in NSS.
**There are valid 1023-bit keys.

.

GlobalSignB*IPConfirmedConfirmedIP* There was one CSP subCA which is no longer issuing.

.

GoDaddy (GoDaddy, Starfield, ValiCert)AN/AConfirmedConfirmedIP

.

Government of France (PM/SGDN, IGC/A)AN/AN/AConfirmedIP

.

Government of Hong Kong (SAR), Hongkong Post ACP/CPS does not
allow MITM usage
N/AConfirmedIP

.

Government of Japan, Ministry of Internal Affairs and Communications (GPKI)AN/AN/AConfirmedIP**The current root signs end-entity certs directly. GPKI is creating a new root certificate and intermediate issuing certificates, and will apply for inclusion of the new root. They will need time to transition all of the certificates from the old root to the new root.

.

Government of Spain (CAV), Izenpe S.A.AN/ACompletedConfirmedIP

.

Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV)AN/AN/AConfirmedIP

.

Government of Taiwan, Government Root Certification Authority (GRCA)AN/AN/AConfirmedIP

.

Government of The Netherlands, PKIoverheid (Staat der Nederlanden, Logius)EIPN/AConfirmedIP

.

Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM)AN/AN/AConfirmedIP

.

Hellenic Academic and Research Institutions Certification Authority (HARICA)ECP/CPS does not
allow MITM usage
N/AConfirmedCompliant

.

IdenTrustBCP/CPS does not
allow MITM usage
N/AConfirmedIP

.

Japan Certification Services, Inc. (JCSI) AN/AN/AConfirmedIP

.

KEYNECTIS (Certplus)BIPConfirmedConfirmedIP

.

Microsec e-Szignó CA ACP/CPS does not allow MITM usageN/AConfirmedIP

.

NetLock Ltd. BIPN/AConfirmedIP

.

QuoVadis BCP/CPS does not
allow MITM usage
ConfirmedConfirmedIP

.

RSA the Security Division of EMC (RSA, ValiCert)BIPN/AConfirmedIP

.

SECOM Trust Systems Co. Ltd. (SECOM, ValiCert) BCP/CPS does not
allow MITM usage
ConfirmedConfirmedIP

.

Start Commercial (StartCom) Ltd. AN/AConfirmedConfirmedCompliant

.

Swisscom Solutions AG BIPConfirmedConfirmedCompliant

.

SwissSign AG BCP/CPS does not allow MITM usageConfirmedConfirmedIP

.

Symantec / TC TrustCenterBIPConfirmedConfirmedIP

.

Symantec / ThawteAN/AConfirmedConfirmedIP

.

Symantec / VeriSignAN/AConfirmedConfirmedIP

.

Symantec / GeoTrust (includes Equifax, USERTRUST)BIPConfirmedConfirmedIP

.

Symantec / RapidSSLBIPConfirmedConfirmedIP

.

Taiwan-CA Inc. (TWCA) AIPConfirmedConfirmedIP

.

TeliaSonera AIPN/AConfirmed**N/A* *SSL trust bit not enabled
**There are valid 1023-bit keys.

.

Trustwave (SecureTrust, Xramp)B*IPConfirmedConfirmedIP*The single exception has already been revoked and the data sent to Mozilla.

.

TurkTrustAN/AConfirmedConfirmedIP

.

Unizeto Certum BIPConfirmedConfirmedIP

.

Verizon Business (Baltimore, Cybertrust, GTE)B*IPConfirmedConfirmedIP*One customer has decided to move to a private root. 99% of their
certs will be migrated by June 30, with the 135 remaining certs being migrated by September 30.

.

VisaAN/AN/AConfirmedIP

.

Web.com (Network Solutions)AN/AIP*ConfirmedIP*No issues found so far, continuing investigation.

.

Wells Fargo Bank AIPConfirmedConfirmedIP

.

WISeKeyBCompletedN/AConfirmedIP