Prioritization of Root CA Inclusion Requests

Skip to first unread message

Ben Wilson

Mar 24, 2021, 6:49:35 PM3/24/21
to mozilla-dev-security-policy

I'd like to have you review the prioritization proposal below, which will
help us as we process CA inclusion requests. (




Prioritization of CA Root Inclusion Requests will be based on the factors
described below and use the P1-P5 Priority categories available in the
Bugzilla system with our own priority categorization for the CA root
inclusion program.


*P1 = High* (Applicant has good compliance history and is replacing an
already-included root)


*P2 = Medium High* (Applicant is well-prepared and responsive, with a
good history of policy compliance)


*P3 = Medium *(Applicant’s request and responsiveness are “average”, but
demonstrates compliance with policies)


*P4 = Medium Low* (Applicant’s responsiveness and compliance history are


*P5 = Low *(Applicant has much work to do, is slow to respond to
requests, or has not demonstrated full compliance with policies)

Factors assessed in setting the above-referenced priorities, in order of
importance, are:

1 - Alignment with Mozilla Manifesto -

2 - Compliance (Based on the compliance history of existing CA operators,
and their responsiveness to issues)

3 - Replacing Existing (Existing CA operators that are replacing an
already-included root certificate)

4 - Responsiveness/Complete and Timely (Applicant provides clear,
complete, concise and timely responses to questions, comments, or concerns
about their root inclusion request)

5 - Single-Purpose, Separate Roots (Hierarchies that are separated by root
for a particular purpose)

6 - CA Hierarchy Control (CA hierarchies comprised solely of CAs fully
controlled by the applicant)

7 - Completeness (Applicant completes all information in CCADB)

8 - CPS Quality (Initially provided CP/CPS documents fully meet Mozilla’s
Root Store Policy and the CAB Forum Baseline Requirements)

9 - Updating Trust Bits or EV-Enablement of Already-Included Root
Certificate (Existing CAs that are only requesting EV enablement or adding
a trust bit to an already-included root certificate)

10 - Ready (Detailed CP/CPS Review is complete and CA is “Ready for

Ben Wilson

Mar 30, 2021, 6:43:50 PM3/30/21
to mozilla-dev-security-policy
For future reference, this is now posted here:
Reply all
Reply to author
0 new messages