HARICA root renewal request for two 2015 rollover roots

HARICA requested Mozilla trust inclusion for two new rollover root certificates: the RSA-based "Hellenic Academic and Research Institutions RootCA 2015" and the ECC-based "Hellenic Academic and Research Institutions ECC RootCA 2015." The request included HARICA’s CA details, audit information, certificate metadata, and the stated intent that these SHA-256 roots would eventually replace the older SHA-1 RootCA 2011. During review, Mozilla asked HARICA to address certlint findings and other questions, including key usage, serial number handling, and certificate policy text. HARICA responded to the review comments, explained its configuration and certificate profile choices, and later said it would remove the keyEncipherment bit for ECDSA certificates. Mozilla then opened public discussion, and after the discussion period ended, approved inclusion of both roots for websites and email trust bits. Mozilla also filed NSS bug 1256494 for the actual changes.

1. 2015-09-03 HARICA requested inclusion of two new rollover root certificates to replace RootCA 2011.
2. 2015-12-10 Mozilla opened public discussion for the HARICA root renewal request.
3. 2016-03-15 Mozilla approved inclusion of the two HARICA roots for websites and email.
4. 2016-03-15 Mozilla filed NSS bug 1256494 for the implementation changes.

1. 2015-09-03 HARICA — HARICA opened the request and provided CA details, audit information, and metadata for the RSA and ECC 2015 roots.
2. 2015-09-16 Mozilla representative — Mozilla said the request had been added to the queue for public discussion.
3. 2015-09-17 Mozilla representative — Mozilla reported that the www3.harica.gr certificate chain issue was due to the server sending certificates in the wrong order.
4. 2015-09-18 HARICA — HARICA said www3.harica.gr was served through SNI and that it had corrected the certificate order on its web server.
5. 2016-02-03 Mozilla representative — Mozilla asked HARICA to run certlint tests and comment back when errors were resolved.
6. 2016-02-04 Community commenter — HARICA responded to certlint findings and explained its positions on key usage, policy text encoding, RFC822Name constraints, and root serial numbers.
7. 2016-02-04 Mozilla representative — Mozilla said certlint had been updated and noted that the key usage issue remained for EC keys.
8. 2016-02-08 Mozilla representative — Mozilla said already-included CA certificates were grandfathered, but new CA certificates must meet the Baseline Requirements and pass certlint without error.
9. 2016-03-07 Mozilla representative — Mozilla stated that the public comment period was over and summarized its assessment under the inclusion policy.
10. 2016-03-08 HARICA — HARICA said it would not use the keyAgreement bit for ECDSA and would remove the keyEncipherment bit.
11. 2016-03-15 Mozilla representative — Mozilla approved inclusion of both HARICA roots for websites and email and said it would file the NSS bug for the changes.