3 ms·
Wtf are you talking about? You don’t pay a browser to get your roots included. You file a bug report, and provide the supporting documentation and audits. If
by olliej 4y ago
Wtf are you talking about?
You don’t pay a browser to get your roots included.
You file a bug report, and provide the supporting documentation and audits. If the relevant root program considers your supporting documentation sufficient, they include you.
You cannot pay a root program to include your root certa, and any CA that was found to have done so would likely find other programs considering that to be a red flag.
- tialaramex 4y agoIt's actually interesting. Three of the major trust stores are also OS vendors. Microsoft, Apple and Google. Each of those three actually just has a rather opaque "send us an email and we'll talk about it" type process. I don't think there's any implication that you can or should pay them money (indeed Microsoft is clear that there is "No Fee" for this), clearly none of these organisations is desperate for cash. But it's actually unclear what you can do besides maybe send email and hope. Mozilla's process is as you state to file a Bugzilla bug. You go in a big queue and there's eventually a public discussion on m.d.s.policy once you get to the front of the queue. Now, in theory there is no relationship between Mozilla's transparent process and say, Apple or Microsoft. Indeed even for Google there's only a rather thin relationship, the final decision is theirs but they do say you need to talk to Mozilla. But in practice the Mozilla process matters most.