Root inclusion request for Thailand National Root CAs G2 and G3

This case is a Mozilla root inclusion request for the Thailand National Root Certificate Authority (ETDA), initially opened to add Thailand National Root CAs G2 and G3. Mozilla asked the CA to provide BR self-assessment material, public test websites for valid/revoked/expired certificates, audit statements, and updated CP/CPS documents. Over time, the thread shows the CA submitting updated CP/CPS versions, self-assessments, audit reports, and test website URLs, while Mozilla continued to request clarifications and public documentation. In 2026, Mozilla noted that the G1 root was no longer the focus and updated the bug title to identify only the G2 and G3 roots. The thread does not show a final inclusion decision in the provided comments.

1. 2017-03-20 Thailand NRCA opened a root inclusion request for G1/G2/G3-related trust material.
2. 2017-05-17 The CA submitted a BR self-assessment and clarification material.
3. 2018-08-31 The CA provided updated CP/CPS and a new BR self-assessment.
4. 2018-09-03 The CA provided test website URLs for valid, revoked, and expired certificate cases.
5. 2022-09-29 The CA reported updated CP/CPS, audit statements, and public test websites.
6. 2023-12-18 The CA reported CP/CPS version 4.4 and an annual CCADB self-assessment.
7. 2026-05-27 Mozilla clarified that the request should focus on G2 and G3 rather than the legacy G1 root.

1. 2017-03-20 Etda representative — Opened the request and provided initial CA information for Thailand National Root CA - G1 and related hierarchy details.
2. 2017-04-17 Mozilla representative — Asked for test websites, a BR self-assessment, and additional CA information.
3. 2017-05-17 Etda representative — Said the BR self-assessment was filled in via Google Docs and attached clarification material.
4. 2017-06-20 Mozilla representative — Said the CA still needed to provide test websites, fix revocation test errors, and upload audit statements.
5. 2017-07-04 Etda representative — Attached the CA's BR self-assessment.
6. 2017-08-16 Mozilla representative — Requested updated CP/CPS documents, the audit statement, an updated BR self-assessment, and three test websites.
7. 2018-08-31 Etda representative — Attached an updated BR self-assessment and listed updated CP/CPS and audit links.
8. 2019-03-18 Mozilla representative — Said the CP/CPS still did not meet Mozilla's requirements and listed remaining issues, including audit history, CAA, OCSP, and test website accessibility.
9. 2022-09-29 Sau representative — Reported that pending issues had been addressed, including audit statements, CAA domain handling, CP/CPS updates, test websites, and lint testing.
10. 2023-12-18 Etda representative — Reported CP/CPS version 4.4 and attached a 2023 self-assessment.
11. 2026-05-27 Mozilla representative — Asked whether the G1 root was still being sought for websites and email trust bits or whether the intent was to replace it with G2 and G3.
12. 2026-05-27 Etda representative — Said G1 is a legacy root and that the organization is building a compliant new hierarchy with G2, G3, and beyond for future trust store submission.
13. 2026-05-27 Mozilla representative — Updated the bug title to focus on the G2 and G3 roots and said the CCADB case would be updated as well.