SwissSign request to include SHA-2 G3 root certificates was denied after audit-history concerns
SwissSign opened this case to request inclusion of three SHA-2 G3 root certificates: SwissSign Gold Root CA - G3, SwissSign Silver Root CA - G3, and SwissSign Platinum Root CA - G3. Mozilla first carried the request through information verification and asked for test websites, audit statements, and a BR self-assessment. Over time, Mozilla raised concerns that some of the audit statements were point-in-time audits rather than period-of-time audits, and that the audit history did not satisfy Mozilla’s root store policy requirements from creation. SwissSign explained that the G3 hierarchy was not yet included in all root stores and said it would perform a corresponding period audit after G3 was in use. In the end, Mozilla concluded that the provided audit history did not meet the requirements for inclusion and said SwissSign could file a new request for newer roots that fully comply from creation.
- SwissSign requested inclusion of SHA-2 G3 root certificates for Gold, Silver, and Platinum hierarchies.
- SwissSign submitted a BR self-assessment.
- Mozilla moved the request back to information verification because two of the audit statements were not period-of-time audits.
- Mozilla stated the audit history did not meet Mozilla Root Store Policy requirements and denied the inclusion request.
- SwissSign AG — SwissSign opened the bug and attached CA details and audit information for the requested G3 roots.
- Mozilla representative — Mozilla asked SwissSign to complete a BR self-assessment as part of the root inclusion process.
- SwissSign AG — SwissSign attached the BR self-assessment document.
- Mozilla representative — Mozilla said the audit statements for two roots were not period-of-time audits and asked SwissSign to either provide complete period-of-time audits or narrow the request to the Gold G3 root only.
- SwissSign AG — SwissSign said the G3 hierarchy was not yet included in all root stores, so it had only point-in-time statements and would switch to period-of-time auditing after G3 inclusion.
- Mozilla representative — Mozilla said the audit history did not meet Mozilla Root Store Policy requirements and denied the request, noting SwissSign could submit a new bug for newer roots.