Preliminary Report - Responses to Mozilla's May 2026 CA Survey

43 views

Skip to first unread message

Ben Wilson

unread,

May 14, 2026, 11:29:53 AM (yesterday) May 14

to dev-secur...@mozilla.org

Hello everyone,

Attached is a preliminary report summarizing the 14 responses received thus far to the Mozilla CA Operator Survey (May 2026).

I am sharing this preliminary summary in the interest of transparency and to help spur additional thought and discussion among CA operators, auditors, and the broader community regarding the topics raised in the survey responses.

The feedback received so far reflects a number of recurring themes, including:

implementation challenges related to CP/CPS documentation changes,
questions regarding the scope, standardization, and timing of Detailed Controls Reports (DCRs),
concerns about auditor coordination, operational burden, and consistency across frameworks,
requests for clearer guidance and harmonization across root program and CCADB expectations, and
questions regarding transition timelines and root inclusion/replacement expectations.

Several respondents also expressed support for the broader goals of improving operational transparency, accountability, and consistency, while highlighting practical implementation and security considerations that may benefit from additional discussion and clarification.

Please note:

This is only a preliminary report based on responses received as of May 14, 2026.
The report is intended to summarize themes and feedback, not to establish conclusions or decisions.
Responses have been summarized and generalized where appropriate.

For CA operators that have not yet responded, I hope this preliminary summary helps provide additional context regarding the types of issues and concerns being raised by peers across the ecosystem. Additional feedback remains welcome and encouraged.

Thanks to everyone who has participated so far and contributed thoughtful input.