Discussion Draft: Detailed Controls Reports White Paper

132 views

Skip to first unread message

Ben Wilson

unread,

Jul 1, 2026, 5:03:49 PM (14 days ago) Jul 1

to dev-secur...@mozilla.org

Greetings,

Following the publication of Mozilla Root Store Policy (MRSP) version 3.1 and the accompanying Detailed Controls Report (DCR) guidance, I have prepared an initial discussion draft of a white paper describing the purpose, structure, and anticipated benefits of DCRs.

The attached draft is intended to supplement the MRSP, the DCR guidance, and the DCR FAQ by providing additional background, implementation considerations, and illustrative examples. It is not a policy document and establishes no new requirements or specifications beyond those already described in section 3.1.5 of the MRSP.

I am sharing this draft to solicit feedback from the community before it is finalized. In particular, I would appreciate comments regarding:

Technical accuracy;
Clarity of the concepts presented;
Practicality of the suggested approaches for CA operators and auditors;
Areas where additional explanation or examples would be helpful; and
Any other suggestions that would improve the document.

Please note that this is a discussion draft. The document is subject to revision based on community feedback prior to publication of a final version.

Thank you in advance to everyone who is willing to review the draft and share comments. I greatly appreciate your time and expertise.