Getting a Root CA accepted in systems and browsers

Question

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.

Answer 1

Different browsers and operating system have different procedures. For example Chrome takes the trust store of the operating system (with the exception of EV certificates) as seen on the Root CA Policy of chromium.

Firefox, on the other hand, maintains all its CAs themselves and doesn't use the systems store at all. They also have a published Inclusion Policy. And of course operating system, like Apples Root Certificate Program.

Generally, all of them require that the CA is certified by an acknowledged authority like WebTrust or something equivalent. To get certified the CA has to prove a few things, like how it determines the owner of a domain, how it keeps the root CAs private key secure, processes and a lot of other things. There is a PDF online from WebTrust with all the requirements. Some examples:

The Certification Authority:

• Discloses its Business, Key Life Cycle Management, Certificate Life Cycle Management, and CA Environmental Control practices in its Certification Practice Statement; and
• Discloses its Business, Key Life Cycle Management, Certificate Life Cycle Management, and CA Environmental Control policies in its Certificate Policy (if applicable). The Certification Authority maintains effective controls to provide reasonable assurance that:
• The CA’s Certification Practice Statement is consistent with its Certificate Policy (if applicable); and
• The CA provides its services in accordance with its Certificate Policy (if applicable) and Certification Practice Statement

and

Service Integrity

The Certification Authority maintains effective controls to provide reasonable assurance that:

• The integrity of keys and certificates it manages is established and protected throughout their life cycles;
• The Subscriber information is properly authenticated (for the registration activities performed by ABC-CA); and
• Subordinate CA certificate requests are accurate, authenticated and approved

Then of course the CA has to provide some value to the operating system or browser vendor. Private CAs won't be added to the root CA store of any browser or OS. A list from Apples Root Certificate Program:

• What is the business purpose of the certificates issued from this root certificate? What business is this root enabling?
• To whom will you issue certificates? For example, the general public, members of a certain organization, and so on.
• What Extended Key Usages does the root support? For example, SSL server authority, secure e-mail, code signing, and so on.
• What is done to validate the identity of someone requesting a certificate issued from this root?
• Pointers to Certificate Practice Statement
• List of any third-party audits your CA practice has undergone. URL of a publicly accessible server where certificates issued from your roots can be verified

As you can see, it isn't that easy to get into the root stores, and the vendors will reevaluate each and every CA in its store periodically. They also remain the right to kick out any CA it deems isn't secure enough, as has happened with DigiNotar.