Chunghwa Telecom root inclusion request denied after misissuance and policy concerns
This case was Chunghwa Telecom’s request to add the renewed ePKI Root Certification Authority - G2 to Mozilla’s root store. Mozilla asked for test websites, a BR self-assessment, audit statements, and CP/CPS updates, and Chunghwa Telecom provided multiple documents and test URLs over the course of the review. The discussion later focused on concerns about missing or unclear CP/CPS language, CAA issuer domain names, and a large number of certificates issued from the Public Certification Authority - G2 intermediate that Mozilla identified as misissued. Chunghwa Telecom said it had paused issuance of the affected certificate type, revoked some certificates, reissued others with a new format, and updated its CPS documents. Mozilla ultimately moved the request into public discussion and then denied it, resolving the bug as WONTFIX and encouraging Chunghwa Telecom to apply again with a new root free of the identified issues.
- Chunghwa Telecom requested inclusion of the renewed ePKI Root Certification Authority - G2.
- Mozilla raised concerns about CP/CPS contents, audit coverage, and misissuance from the Public Certification Authority - G2 intermediate.
- Chunghwa Telecom said it had paused issuance of the affected certificate type and planned revocation and reissuance.
- Mozilla denied the request and resolved the bug WONTFIX.
- Cht representative — Chunghwa Telecom opened the request and attached CP, CPS, audit, and root certificate details for ePKI Root Certification Authority - G2.
- Mozilla representative — Mozilla began information verification and asked for the missing CA response items and valid/revoked/expired test pages.
- Mozilla representative — Mozilla requested a BR self-assessment document.
- Cht representative — Chunghwa Telecom provided updated test links, audit statements, and said it had tried to create an audit case.
- Mozilla representative — Mozilla asked Chunghwa Telecom to add EV treatment information and EV test websites.
- Cht representative — Chunghwa Telecom described the EV treatment and provided EV valid, revoked, and expired test URLs.
- Fastly representative — Mozilla raised detailed concerns about CAA issuer domain names, older audit statements, and many misissued certificates from the intermediate.
- Cht representative — Chunghwa Telecom attached older WebTrust and BR audit statements and provided explanations for the reported certificate issues.
- Fastly representative — Mozilla moved the request into public discussion and summarized the good, meh, and bad findings.
- Cht representative — Chunghwa Telecom said it had paused issuance of the affected certificate type, planned a new format, and would revoke and reissue certificates.
- Cht representative — Chunghwa Telecom reported that the remaining proprietary server application software certificates had been revoked and new certificates were provided.
- Fastly representative — Mozilla said the request should be denied and resolved the bug WONTFIX.