CA/Root Store Policy Archive

Process for Updating the Policy

The general process that will be followed to update the Mozilla CA Certificate Policy is as follows. Issues and potential changes will be tracked in the policy issue tracker.

1. A Mozilla representative will bring forward an item for discussion in the mozilla.dev.security.policy forum.
2. There will be a discussion of how, if at all, to modify the policy for the item.
3. At some point, which may be at the start, a Mozilla representative will draft proposed text.
4. A Mozilla representative will summarize a consensus that has been reached, and/or state the official position of Mozilla in both the discussion in mozilla.dev.security.policy and in the policy issue tracker.
5. The draft policy in Github will be updated, if required.
6. The issue will be closed.

At intervals, a new policy version will be released based on the current draft, along with a timeline for compliance.

• A Mozilla representative will post notice in the mozilla.dev.security.policy, mozilla.dev.security, and mozilla.governance forums.
• A Mozilla representative will send email communication to CAs, indicate the compliance schedule.

Versions of the Policy

2.3

• Policy document
• Publication date: December 19, 2016
• Compliance date: December 19, 2016
• List of changes and diff

2.2

• Policy document
• Publication date: July 26, 2013
• Compliance date: July 26, 2013 (more specific details)
• List of changes: bug 868144

2.1

• Policy document
• Publication date: February 14, 2013
• Compliance date: February 14, 2014 (more specific details)
• Items considered: CA:PolicyVersion2.1
• List of changes: bug 763758

2.0

• Policy document
• Publication date: February 2, 2011
• Compliance date: August 8, 2011 (Feb 2, 2011 for new root inclusions)
• Items considered: CA:PolicyVersion2.0
• List of changes: bug 609945

Earlier

• Version 1.2 -- January 2008
• Version 1.1 -- November 2007
• Version 1.0 -- November 2005
• Version 0.4 -- March 2004