CA:Schedule
Contents
Schedule for CA evaluations
Note that this schedule is tentative and may change without warning based on unforeseen circumstances. Nothing in this schedule shall be construed as a commitment by the Mozilla Foundation or the Mozilla project in general.
General timeline
Our process for evaluating CA requests is as follows:
- CAs will be added into the queue for public discussion after they have completed the Information Gathering and Verification phase as described in CA:How_to_apply.
- Prior to entering public discussion we may need to gather further information or an updated audit from the CA; if for some reason we cannot obtain the needed information then the next CA in the queue will be considered for public discussion.
- Once a CA enters the public discussion period a representative of the CA must promptly respond in the discussion to any questions or concerns that are raised. If a CA delays their response for more than one week, then their discussion may be closed.
- During the course of the discussion, we will make a decision as to whether to approve the request.
- If the discussion results in moving forward with approval, then a representative of Mozilla will summarize the request in the bug, and indicate the plan to approve the request. After about one week, if no further questions or concerns are raised, then the representative of Mozilla may approve the request. Once a request is approved then a representative of Mozilla will file bug(s) against the appropriate developer(s) to have the necessary changes made to NSS (for CA root inclusion) or PSM (for EV-enabling a CA) or both.
- If a request is not approved due to outstanding issues that need to be addressed (e.g., a need for further information, or concerns about CA practices) then the request will wither be closed, or will be added to the list of CAs responding to the first discussion. A second round of public discussion may be needed after the issues have been resolved.
Once bugs are filed against NSS and/or PSM the schedule is set first by the NSS/PSM developer(s) (for making the technical changes) and then by the product teams for Firefox and other products (to include the new changes in a release of Firefox, etc.) Root certificate changes to NSS/PSM are usually grouped and done as a batch when there is either a large enough set of changes or about every 3 months. When the developer makes the changes, a test build will be provided and the bug will be updated to request that you test it. After the NSS/PSM changes are committed to an NSS release, then a future version of Firefox will include the updated version of NSS/PSM.
Queue for Public Discussion
The following queue indicates the order in which requests will enter public discussion for root inclusion request from CAs who do not currently have a root certificate included in NSS. In general, only one or two of these requests may be in discussion at any given point. The amount of time that each discussion takes varies dramatically depending on the number of reviewers contributing to the discussion, and the types of concerns that are raised. For each discussion, there must be input from at least two people who have reviewed and commented on the request. To be added to this queue, a request must first achieve the "Information Confirmed Complete" status.
| CA Company Name | Bug ID | Geographic focus | Audit Date yyyy.mm.dd | Status | Notes |
|---|---|---|---|---|---|
| - | - | - | - | - | |
| KIR | 817994 | Poland | 2014.05.05 | Started Second Discussion on Feb 9 | |
| LuxTrust | 944783 | Luxembourg | 2014.07.23 | Started First Discussion on Feb 11 | EV |
| - | - | - | - | - |
Requests from Already Included CAs that are in or Ready for Discussion
These requests are from CAs that already have roots included in NSS. The requests may be discussed in parallel; the goal is to start each discussion as soon as the information is ready. In general, these requests will remain in discussion for 2 weeks unless further discussion is warranted. To be added to this queue, a request must first achieve the "Information Confirmed Complete" status.
| CA Company Name | Bug ID | Geographic focus | Audit Date yyyy.mm.dd | Status | Notes |
|---|---|---|---|---|---|
| Certinomis | 937589 | France | 2014.06.30 | Started Discussion on Dec 18 | Waiting for CA to provide English translation of current CP - ETA early February |
| TÜRKTRUST | 1007683 | Turkey | 2014.12.19 | Started Discussion on Feb 12 | EV |
| - | - | - | - | - | |
| - | - | - | - | - |
CAs Responding to First Discussion
The following list shows the CAs who have gone through the first round of public discussion, and have resulting action items to complete before the second round of public discussion may begin.
| CA Company Name | Bug ID | Geographic focus | Audit Date yyyy.mm.dd | Status | Notes | |
|---|---|---|---|---|---|---|
| KISA | 335197 | Korea | Need Audit | Super-CA | Super-CA -- Sub-CAs should apply for inclusion separately | |
| SSC, Lithuanian National Root | 379152 | Lithuania | Need Audit | Responding to First Discussion | national government CA, Update root roles, CPS, audit | |
| Verizon/CyberTrust | 430698 | global | Need Audit | Responding to First Discussion | EV, no OCSP, has resellers | |
| Swiss BIT | 435026 | Switzerland | Need Audit | Responding to First Discussion | Need new root with clear Issuer info, Update CPS | |
| ICP-Brasil | 438825 | Brazil | Need Audit | Super-CA | Super-CA -- Sub-CAs should apply for inclusion separately | |
| Finnish Population Register | 463989 | Finland | 2008.02.28 | Responding to First Discussion | national government CA. Need audit for SSL and code signing CPS | |
| US FPKI | 478418 | US | 2012.02.28 | Technical Evaluation and Testing | national government CA | |
| E-ME | 518098 | Latvia | 2011.05.02 | Approval Pending Discussion Action Items | bug 518098#c95 | |
| ANF | 555156 | European Union | 2013.12.20 | Responding to First Discussion | EV | |
| CSOEC | 844163 | France | 2012.11.26 | On Hold | Primary Point of Contact (POC) and relevance concerns |
Requests in the Information Gathering and Verification Phase
The following CAs are in the Information Gathering and Verification Phase as described in CA:How_to_apply. These requests need to complete the Information Gathering and Verification Phase before they can be put into the queue for public discussion.
| CA Company Name | Bug ID Number | Geographic focus | Notes |
|---|---|---|---|
| FNMT | bug 435736 | Spain | national government CA, Need updated info, audit |
| SUSCERTE | bug 489240 | Venezuela | Super-CA -- Sub-CAs should apply for inclusion separately |
| CCA | bug 557167 | India | Super-CA -- Sub-CAs should apply for inclusion separately |
| IDRBT | bug 562764 | India | Signed by India CCA, Constrain per bug 557167#c25 |
| SHECA | bug 566310 | China | |
| Collier | bug 590593 | US | add to pending |
| Netrust | bug 632292 | Singapore | |
| Visa | bug 636557 | Global | |
| EADTrust | bug 640135 | Spain | add to pending, Regional government CA |
| PostSignum | bug 643398 | Czech Republic | National government CA |
| PSC-FII | bug 667466 | Venezuela | Signed by SUSCERTE (bug #489240) |
| ComSign | bug 675060 | Israel | Need BR audit |
| CATCert | bug 720326 | Spain | EV |
| SITHS | bug 792337 | Sweden | |
| Symantec/VeriSign | bug 833974 | Global | EV for included ECC root |
| Symantec | bug 833986 | Global | Symantec-brand Class 1 and Class 2 roots |
| Symantec/Thawte | bug 833998 | Global | EV for included ECC root |
| Symantec/GeoTrust | bug 834004 | Global | EV for included ECC root |
| OATI | bug 848766 | US | |
| E-Guven | bug 854384 | Turkey | add to pending |
| MOSPA | bug 867002 | Korea | Government CA, add to pending |
| GPKI | bug 870185 | Japan | Government CA |
| ACRN | bug 925740 | Uruguay | |
| Athens Exchange | bug 967387 | Greece | |
| AC Camerfirma | bug 986854 | Spain | EV, add to pending |
| Unizeto Certum | bug 999378 | Poland | EV |
| LAWtrust | bug 1023726 | South Africa | |
| Orange/Signet | bug 1024418 | Poland | |
| OpenTrust | bug 1025095 | France | |
| MULTICERT | bug 1040072 | Portugal | |
| certEurope | bug 1050249 | Europe | add to pending |
| Taiwan GRCA | bug 1065896 | Taiwan | |
| SAPO | bug 1067887 | South Africa | |
| TMCA | bug 1090014 | Malaysia | |
| A-Trust | bug 1092963 | Austria | EV |
| SECOM | bug 1096205 | Japan | EV |
| Symantec | bug 1099311 | Global | Symantec-brand Class 3 roots, add to pending |
| Firmaprofesional | bug 1102143 | Spain | EV |
| GDCA | bug 1128392 | China | EV |
| Red Abogacia | bug 1130333 | Spain | |
| Wifi4india | bug 1132806 | India | add to pending |
Requests in the Inclusion Phase
The following CAs have been approved and are in the Inclusion Phase as described in CA:How_to_apply.
| CA Company Name | Bug ID | Geographic focus | Notes |
|---|---|---|---|
| Entrust | 849950 | Global | EV |
| CFCA | 926029 | China | EV |
| S-TRUST (DSV Gruppe) | 1011182 | Germany | |
| Staat der Nederlanden | 1016568 | Netherlands | EV |
| IdenTrust | 1037590 | US |
