Mozilla

CA Program

Case Information

Subject
Root Inclusion For Atos
Bugzilla Bug (link)
https://bugzilla.mozilla.org/show_bug.cgi?id=1782092
CA Owner/Certificate Name
Eviden
Value Statement (Link)
Case Number
00000999
Case Record Type
Root Inclusion Request
Mozilla Request Status
Complete

CA Information

Company Website
https://pki.atos.net/TrustedRoot/
Organizational Type
Private Corporation
Geographic Focus
Germany, Europe
Primary Market / Customer Base
Eviden Trustcenter acts in Europe, but also has international customers. The PKI-Services are offered to the Public, with no restrictions to user groups.
Recognized CAA Domains
Problem Reporting Mechanism
CA Address
Lohberg 10MeppenGermany49716
Root Certificate Record # 1

Root Certificate Information

Root Certificate Name
Atos TrustedRoot Root CA RSA G2 2020
Root Case Number
R00002214
Mozilla Certificate Request Status
Included
Case Number
00000999

Certificate Data Extracted from PEM

Subject
CN=Atos TrustedRoot Root CA RSA G2 2020; O=Atos; C=DE
Issuer
CN=Atos TrustedRoot Root CA RSA G2 2020; O=Atos; C=DE
Valid From
2020 Dec 15
Valid To
2040 Dec 10
Certificate Serial Number
47BA2946553E169297B0AB40
SHA-1 Fingerprint
32D127FA93B1C14C99E24A40BC7F94411B5AACA4
SHA-256 Fingerprint
78833A783BB2986C254B9370D3C20E5EBA8FA7840CBF63FE17297A0B0119685E
Signature Hash Algorithm
SHA384WithRSA
Public Key Algorithm
RSA 4096 bits
SPKI SHA256
21E94DDBFA686CBBFB802689F5B0D768356FB64E361DBCB7EAAD0F406BCB3171
Subject + SPKI SHA256
D82A9DD7A2A04400EA6314AF287D1CCD17FE7FEE1F9E214EFF82AE5423C9CB84

Application Information

Explanation and Role
Our existing "Atos TrustedRoot 2011" is valid until January 1st 2031.
New Sub CAs issued by this Root CA have already shortened lifetimes of less than 10 years.
Additionally cryptographic requirements have changed and we want to support stronger keys / key algorithms like RSA 4096 or ECC. So it was time to create new Root CAs and to start the process of integrating them into the root store.
This Root CA will issue Sub CAs which will issue certificates for user authentication or encryption, but no TLS certificates. All certificates in this chain will use RSA keys
Root Certificate Download URL
https://pki-crl.atos.net/certificates/AtosTrustedRootRootCARSAG22020.pem
Mozilla Trust Bits
Email
Mozilla EV Policy OID(s)
Mozilla Applied Constraints

Self-Assessment

Self-Assessment Completion Date
6/30/2023

Key Generation

Key Generation Date
12/7/2020
Key Generation Audit Report Date
4/22/2021
Key Generation Audit Report (Link)

Audit Statements

Auditor
datenschutz cert GmbH
Auditor Location
Germany
Standard Audit Type
ETSI EN 319 411
Standard Audit Deviation
false
Standard Audit Statement Date
7/5/2023
Standard Audit Period Start Date
4/27/2022
Standard Audit ALV Comments
Standard Audit Period End Date
4/26/2023
NetSec Audit Statement (Link)
NetSec Audit Type
NetSec Audit Deviation
false
NetSec Audit Statement Date
NetSec Audit Period Start Date
NetSec Audit Period End Date
TLS BR Audit Type
ETSI EN 319 411
BR Audit Deviation
false
TLS BR Audit Statement Date
7/5/2023
TLS BR Audit Period Start Date
4/27/2022
TLS BR Audit ALV Comments
TLS BR Audit Period End Date
4/26/2023
TLS EVG Audit Statement (Link)
TLS EVG Audit Type
 
TLS EVG Audit Deviation
false
TLS EVG Audit Statement Date
 
TLS EVG Audit Period Start Date
 
TLS EVG Audit ALV Comments
TLS EVG Audit Period End Date
 
S/MIME BR Audit Statement (Link)
S/MIME BR Audit Type
S/MIME BR Audit Deviation
false
S/MIME BR Audit Statement Date
S/MIME BR Audit Period Start Date
S/MIME BR Audit Period End Date

Policy Document Record # 1

Document Type
CP/CPS
Document Link
https://pki.atos.net/Download/Eviden_TrustedRoot_CPS_v3.0.pdf
Document Last Updated Date
3/6/2024
Associated Trust Bits
Server Authentication; Client Authentication; Code Signing; Secure Email; Time Stamping
Policy Identifiers
1.3.6.1.4.1.6189.5.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.2; 1.3.6.1.4.1.6189.5.1.1.1.3; 1.3.6.1.4.1.6189.5.1.1.1.5; 2.23.140.1.2.1; 2.23.140.1.2.2; 2.23.140.1.2.3; 1.3.6.1.4.1.6189.3.4.1.1
Comments
Applies to issuing Root, Issuing CAs and issuing end entity certificates.

CA Hierarchy Information

Cross-Signed by another Root Cert?
No
Cross Signed by Another CA Operator?
No
Has Externally Operated SubCAs?
No
CP/CPS allows Ext Operated SubCAs?
No
Has External Registration Authorities?
Yes
CP/CPS allows External RAs?
Yes
Description of PKI Hierarchy
Subordinate CA is currently Atos TrustedRoot Client CA RSA 2022
Intended Use Case(s) Served
Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4; Client Authentication 1.3.6.1.5.5.7.3.2
CA/B Forum Certificate Policy Identifier
N/A
TLS Certificate Domain Validation Method
N/A - non-TLS CA

Test Websites or Example Cert

Test Website - Valid
Test Website - Expired
Test Website - Revoked

Test Results (When Requesting the SSL/TLS Trust Bit)

Revocation Tested
N/A
CA/Browser Forum Lint Test
N/A
EV Tested
N/A
Root Certificate Record # 2

Root Certificate Information

Root Certificate Name
Atos TrustedRoot Root CA RSA TLS 2021
Root Case Number
R00002215
Mozilla Certificate Request Status
Included
Case Number
00000999

Certificate Data Extracted from PEM

Subject
CN=Atos TrustedRoot Root CA RSA TLS 2021; O=Atos; C=DE
Issuer
CN=Atos TrustedRoot Root CA RSA TLS 2021; O=Atos; C=DE
Valid From
2021 Apr 22
Valid To
2041 Apr 17
Certificate Serial Number
53D5CFE619930BFB2B0512D8C22AA2A4
SHA-1 Fingerprint
18523B0D0637E4D63ADF23E498FB5B16FB867448
SHA-256 Fingerprint
81A9088EA59FB364C548A6F85559099B6F0405EFBF18E5324EC9F457BA00112F
Signature Hash Algorithm
SHA384WithRSA
Public Key Algorithm
RSA 4096 bits
SPKI SHA256
F7CA77A610E3D42447240692DBD57CFD13CF042ACD2062E6A62B87B9ED81C1A7
Subject + SPKI SHA256
0565EA5E2C5DF980D4563529DFF280D99010CF02A8E50F2376DD795FA97DDBF6

Application Information

Explanation and Role
Our existing "Atos TrustedRoot 2011" is valid until January 1st 2031.
New Sub CAs issued by this Root CA have already shortened lifetimes of less than 10 years.
Additionally cryptographic requirements have changed and we want to support stronger keys / key algorithms like RSA 4096 or ECC. So it was time to create new Root CAs and to start the process of integrating them into the root store.
This Root CA will issue Sub CAs which will only issue TLS client/server certificates. All certificates in this chain will use RSA keys.
Root Certificate Download URL
https://pki-crl.atos.net/certificates/AtosTrustedRootRootCARSATLS2021.pem
Mozilla Trust Bits
Websites
Mozilla EV Policy OID(s)
Mozilla Applied Constraints

Self-Assessment

Self-Assessment Completion Date
6/30/2023

Key Generation

Key Generation Date
12/7/2020
Key Generation Audit Report Date
4/22/2021
Key Generation Audit Report (Link)

Audit Statements

Auditor
datenschutz cert GmbH
Auditor Location
Germany
Standard Audit Type
ETSI EN 319 411
Standard Audit Deviation
false
Standard Audit Statement Date
7/5/2023
Standard Audit Period Start Date
4/27/2022
Standard Audit ALV Comments
Standard Audit Period End Date
4/26/2023
NetSec Audit Statement (Link)
NetSec Audit Type
NetSec Audit Deviation
false
NetSec Audit Statement Date
NetSec Audit Period Start Date
NetSec Audit Period End Date
TLS BR Audit Type
ETSI EN 319 411
BR Audit Deviation
false
TLS BR Audit Statement Date
7/5/2023
TLS BR Audit Period Start Date
4/27/2022
TLS BR Audit ALV Comments
TLS BR Audit Period End Date
4/26/2023
TLS EVG Audit Statement (Link)
TLS EVG Audit Type
 
TLS EVG Audit Deviation
false
TLS EVG Audit Statement Date
 
TLS EVG Audit Period Start Date
 
TLS EVG Audit ALV Comments
TLS EVG Audit Period End Date
 
S/MIME BR Audit Statement (Link)
S/MIME BR Audit Type
S/MIME BR Audit Deviation
false
S/MIME BR Audit Statement Date
S/MIME BR Audit Period Start Date
S/MIME BR Audit Period End Date

Policy Document Record # 1

Document Type
CP/CPS
Document Link
https://pki.atos.net/Download/Eviden_TrustedRoot_CPS_v3.0.pdf
Document Last Updated Date
3/6/2024
Associated Trust Bits
Server Authentication; Client Authentication; Code Signing; Secure Email; Time Stamping
Policy Identifiers
1.3.6.1.4.1.6189.5.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.2; 1.3.6.1.4.1.6189.5.1.1.1.3; 1.3.6.1.4.1.6189.5.1.1.1.5; 2.23.140.1.2.1; 2.23.140.1.2.2; 2.23.140.1.2.3; 1.3.6.1.4.1.6189.3.4.1.1
Comments
Applies to issuing Root, Issuing CAs and issuing end entity certificates.

CA Hierarchy Information

Cross-Signed by another Root Cert?
No
Cross Signed by Another CA Operator?
No
Has Externally Operated SubCAs?
No
CP/CPS allows Ext Operated SubCAs?
No
Has External Registration Authorities?
Yes
CP/CPS allows External RAs?
Yes
Description of PKI Hierarchy
Subordinate CA is currently Atos TrustedRoot Server CA RSA 2022
Intended Use Case(s) Served
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1; Client Authentication 1.3.6.1.5.5.7.3.2
CA/B Forum Certificate Policy Identifier
domain-validated 2.23.140.1.2.1; organization-validated 2.23.140.1.2.2; individual-validated 2.23.140.1.2.3
TLS Certificate Domain Validation Method
3.2.2.4.4 Constructed Email to Domain Contact; 3.2.2.4.7 DNS Change; 3.2.2.4.12 Validating Applicant as a Domain Contact; 3.2.2.4.19 Agreed-Upon Change to Website - ACME

Test Websites or Example Cert

Test Website - Valid
https://tls-rsa-root-2021-pki-valid.atos.net
Test Website - Expired
https://tls-rsa-root-2021-pki-expired.atos.net
Test Website - Revoked
https://tls-rsa-root-2021-pki-revoked.atos.net

Test Results (When Requesting the SSL/TLS Trust Bit)

Revocation Tested
http://certificate.revocationcheck.com/tls-rsa-root-2021-pki-valid.atos.net - PASSED
CA/Browser Forum Lint Test
PASSED https://cachecker-dot-ccadb-231121.appspot.com
EV Tested
N/A
Root Certificate Record # 3

Root Certificate Information

Root Certificate Name
Atos TrustedRoot Root CA ECC G2 2020
Root Case Number
R00002216
Mozilla Certificate Request Status
Included
Case Number
00000999

Certificate Data Extracted from PEM

Subject
CN=Atos TrustedRoot Root CA ECC G2 2020; O=Atos; C=DE
Issuer
CN=Atos TrustedRoot Root CA ECC G2 2020; O=Atos; C=DE
Valid From
2020 Dec 15
Valid To
2040 Dec 10
Certificate Serial Number
0B7328111874301CEF6F0884
SHA-1 Fingerprint
612556DA6294E5AEB33CF811BDB1DCF8A5D8B3E4
SHA-256 Fingerprint
E38655F4B0190C84D3B3893D840A687E190A256D98052F159E6D4A39F589A6EB
Signature Hash Algorithm
ecdsaWithSHA384
Public Key Algorithm
EC secp384r1
SPKI SHA256
C3C0811992CCBC2C282D2C30022DBCE857DBA2A0CFB99887E33BB6986C916EAE
Subject + SPKI SHA256
8C8EF96EA1555DFBA2DB79B20E10922327D8580293396B82A3C3872795AE5D89

Application Information

Explanation and Role
Our existing "Atos TrustedRoot 2011" is valid until January 1st 2031.
New Sub CAs issued by this Root CA have already shortened lifetimes of less than 10 years.
Additionally cryptographic requirements have changed and we want to support stronger keys / key algorithms like RSA 4096 or ECC. So it was time to create new Root CAs and to start the process of integrating them into the root store.
This Root CA will issue Sub CAs which will issue certificates for user authentication or encryption, but no TLS certificates. All certificates in this chain will use ECC key
Root Certificate Download URL
https://pki-crl.atos.net/certificates/AtosTrustedRootRootCAECCG22020.pem
Mozilla Trust Bits
Email
Mozilla EV Policy OID(s)
Mozilla Applied Constraints

Self-Assessment

Self-Assessment Completion Date
6/30/2023

Key Generation

Key Generation Date
12/7/2020
Key Generation Audit Report Date
4/22/2021
Key Generation Audit Report (Link)

Audit Statements

Auditor
datenschutz cert GmbH
Auditor Location
Germany
Standard Audit Type
ETSI EN 319 411
Standard Audit Deviation
false
Standard Audit Statement Date
7/5/2023
Standard Audit Period Start Date
4/27/2022
Standard Audit ALV Comments
Standard Audit Period End Date
4/26/2023
NetSec Audit Statement (Link)
NetSec Audit Type
NetSec Audit Deviation
false
NetSec Audit Statement Date
NetSec Audit Period Start Date
NetSec Audit Period End Date
TLS BR Audit Type
ETSI EN 319 411
BR Audit Deviation
false
TLS BR Audit Statement Date
7/5/2023
TLS BR Audit Period Start Date
4/27/2022
TLS BR Audit ALV Comments
TLS BR Audit Period End Date
4/26/2023
TLS EVG Audit Statement (Link)
TLS EVG Audit Type
 
TLS EVG Audit Deviation
false
TLS EVG Audit Statement Date
 
TLS EVG Audit Period Start Date
 
TLS EVG Audit ALV Comments
TLS EVG Audit Period End Date
 
S/MIME BR Audit Statement (Link)
S/MIME BR Audit Type
S/MIME BR Audit Deviation
false
S/MIME BR Audit Statement Date
S/MIME BR Audit Period Start Date
S/MIME BR Audit Period End Date

Policy Document Record # 1

Document Type
CP/CPS
Document Link
https://pki.atos.net/Download/Eviden_TrustedRoot_CPS_v3.0.pdf
Document Last Updated Date
3/6/2024
Associated Trust Bits
Server Authentication; Client Authentication; Code Signing; Secure Email; Time Stamping
Policy Identifiers
1.3.6.1.4.1.6189.5.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.2; 1.3.6.1.4.1.6189.5.1.1.1.3; 1.3.6.1.4.1.6189.5.1.1.1.5; 2.23.140.1.2.1; 2.23.140.1.2.2; 2.23.140.1.2.3; 1.3.6.1.4.1.6189.3.4.1.1
Comments
Applies to issuing Root, Issuing CAs and issuing end entity certificates.

CA Hierarchy Information

Cross-Signed by another Root Cert?
No
Cross Signed by Another CA Operator?
No
Has Externally Operated SubCAs?
No
CP/CPS allows Ext Operated SubCAs?
No
Has External Registration Authorities?
Yes
CP/CPS allows External RAs?
Yes
Description of PKI Hierarchy
Subordinate CA is currently Atos TrustedRoot Client CA ECC 2022
Intended Use Case(s) Served
Secure Email (S/MIME) 1.3.6.1.5.5.7.3.4; Client Authentication 1.3.6.1.5.5.7.3.2
CA/B Forum Certificate Policy Identifier
N/A
TLS Certificate Domain Validation Method
N/A - non-TLS CA

Test Websites or Example Cert

Test Website - Valid
Test Website - Expired
Test Website - Revoked

Test Results (When Requesting the SSL/TLS Trust Bit)

Revocation Tested
N/A
CA/Browser Forum Lint Test
N/A
EV Tested
N/A
Root Certificate Record # 4

Root Certificate Information

Root Certificate Name
Atos TrustedRoot Root CA ECC TLS 2021
Root Case Number
R00002217
Mozilla Certificate Request Status
Included
Case Number
00000999

Certificate Data Extracted from PEM

Subject
CN=Atos TrustedRoot Root CA ECC TLS 2021; O=Atos; C=DE
Issuer
CN=Atos TrustedRoot Root CA ECC TLS 2021; O=Atos; C=DE
Valid From
2021 Apr 22
Valid To
2041 Apr 17
Certificate Serial Number
3D983BA6663D9063F77E26573804EF00
SHA-1 Fingerprint
9EBC751042B302F381F4F73062D48FC3A751B2DD
SHA-256 Fingerprint
B2FAE53E14CCD7AB9212064701AE279C1D8988FACB775FA8A008914E663988A8
Signature Hash Algorithm
ecdsaWithSHA384
Public Key Algorithm
EC secp384r1
SPKI SHA256
608963C78C455E6E34B072468ACE0956CFF18D34643F9F305B7162FA181979FC
Subject + SPKI SHA256
E8D0B2943BD599B8F33818D6A84769D49AD1B65FB26233221DC0F55D45DA1DC1

Application Information

Explanation and Role
Our existing "Atos TrustedRoot 2011" is valid until January 1st 2031.
New Sub CAs issued by this Root CA have already shortened lifetimes of less than 10 years.
Additionally cryptographic requirements have changed and we want to support stronger keys / key algorithms like RSA 4096 or ECC. So it was time to create new Root CAs and to start the process of integrating them into the root store.
This Root CA will issue Sub CAs which will only issue TLS client/server certificates. All certificates in this chain will use ECC keys.
Root Certificate Download URL
https://pki-crl.atos.net/certificates/AtosTrustedRootRootCAECCTLS2021.pem
Mozilla Trust Bits
Websites
Mozilla EV Policy OID(s)
Mozilla Applied Constraints

Self-Assessment

Self-Assessment Completion Date
6/30/2023

Key Generation

Key Generation Date
12/7/2020
Key Generation Audit Report Date
4/22/2021
Key Generation Audit Report (Link)

Audit Statements

Auditor
datenschutz cert GmbH
Auditor Location
Germany
Standard Audit Type
ETSI EN 319 411
Standard Audit Deviation
false
Standard Audit Statement Date
7/5/2023
Standard Audit Period Start Date
4/27/2022
Standard Audit ALV Comments
Standard Audit Period End Date
4/26/2023
NetSec Audit Statement (Link)
NetSec Audit Type
NetSec Audit Deviation
false
NetSec Audit Statement Date
NetSec Audit Period Start Date
NetSec Audit Period End Date
TLS BR Audit Type
ETSI EN 319 411
BR Audit Deviation
false
TLS BR Audit Statement Date
7/5/2023
TLS BR Audit Period Start Date
4/27/2022
TLS BR Audit ALV Comments
TLS BR Audit Period End Date
4/26/2023
TLS EVG Audit Statement (Link)
TLS EVG Audit Type
 
TLS EVG Audit Deviation
false
TLS EVG Audit Statement Date
 
TLS EVG Audit Period Start Date
 
TLS EVG Audit ALV Comments
TLS EVG Audit Period End Date
 
S/MIME BR Audit Statement (Link)
S/MIME BR Audit Type
S/MIME BR Audit Deviation
false
S/MIME BR Audit Statement Date
S/MIME BR Audit Period Start Date
S/MIME BR Audit Period End Date

Policy Document Record # 1

Document Type
CP/CPS
Document Link
https://pki.atos.net/Download/Eviden_TrustedRoot_CPS_v3.0.pdf
Document Last Updated Date
3/6/2024
Associated Trust Bits
Server Authentication; Client Authentication; Code Signing; Secure Email; Time Stamping
Policy Identifiers
1.3.6.1.4.1.6189.5.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.1; 1.3.6.1.4.1.6189.5.1.1.1.2; 1.3.6.1.4.1.6189.5.1.1.1.3; 1.3.6.1.4.1.6189.5.1.1.1.5; 2.23.140.1.2.1; 2.23.140.1.2.2; 2.23.140.1.2.3; 1.3.6.1.4.1.6189.3.4.1.1
Comments
Applies to issuing Root, Issuing CAs and issuing end entity certificates.

CA Hierarchy Information

Cross-Signed by another Root Cert?
No
Cross Signed by Another CA Operator?
No
Has Externally Operated SubCAs?
No
CP/CPS allows Ext Operated SubCAs?
No
Has External Registration Authorities?
Yes
CP/CPS allows External RAs?
Yes
Description of PKI Hierarchy
Current subordinate/intermediate CA is Atos TrustedRoot Server CA ECC 2022.
Intended Use Case(s) Served
Server Authentication (TLS) 1.3.6.1.5.5.7.3.1; Client Authentication 1.3.6.1.5.5.7.3.2
CA/B Forum Certificate Policy Identifier
domain-validated 2.23.140.1.2.1; organization-validated 2.23.140.1.2.2; individual-validated 2.23.140.1.2.3
TLS Certificate Domain Validation Method
3.2.2.4.4 Constructed Email to Domain Contact; 3.2.2.4.7 DNS Change; 3.2.2.4.12 Validating Applicant as a Domain Contact; 3.2.2.4.19 Agreed-Upon Change to Website - ACME

Test Websites or Example Cert

Test Website - Valid
https://tls-ecc-root-2021-pki-valid.atos.net
Test Website - Expired
https://tls-ecc-root-2021-pki-expired.atos.net
Test Website - Revoked
https://tls-ecc-root-2021-pki-revoked.atos.net

Test Results (When Requesting the SSL/TLS Trust Bit)

Revocation Tested
http://certificate.revocationcheck.com/tls-ecc-root-2021-pki-valid.atos.net - PASSED
CA/Browser Forum Lint Test
PASSED - https://cachecker-dot-ccadb-231121.appspot.com/
EV Tested
N/A