Hongkong Post Root CA 3 inclusion request for websites trust and EV treatment

This case was a request by Hongkong Post Certification Authority (HKPCA), operated by Certizen, to include the new root certificate "Hongkong Post Root CA 3" in Mozilla with the websites trust bit enabled and EV treatment. The request was triggered by Hongkong Post's planned rollover from its existing root, which was approaching expiry, and by its plan to separate client and SSL issuance into different PKIs. Hongkong Post provided CA information, a BR self-assessment, audit materials, and CPS documents, and later published a pre-production CPS and an EV SSL WebTrust report. Mozilla reviewers asked for clarifications and updates to the CPS, including revocation reasons, suspension language, external RA/domain validation language, and EV audit timing. After public discussion and a recommendation to approve, Mozilla approved the request and filed follow-up NSS and PSM bugs for the actual changes.

1. 2018-05-25 Hongkong Post requested inclusion of the new root certificate Hongkong Post Root CA 3 for websites and EV use.
2. 2019-01-15 Mozilla began the public discussion of the root inclusion request.
3. 2019-03-05 Mozilla approved inclusion of Hongkong Post Root CA 3 with websites trust and EV treatment.

1. 2018-05-25 Certizen representative — Hongkong Post opened the request and explained the planned rollover from Root CA 1 to Root CA 2 and Root CA 3.
2. 2018-05-31 Mozilla representative — Mozilla acknowledged receipt and said the request was added to the review queue.
3. 2018-08-23 Mozilla representative — Mozilla asked whether the request covered two new roots or only Root CA 3.
4. 2018-08-23 Certizen representative — Hongkong Post clarified that the request only included Root CA 3 for website trust and EV treatment.
5. 2018-09-20 Fastly representative — Wayne Thayer began review and raised questions about the EV audit, CPS publication, external RAs, suspension, and revocation reasons.
6. 2018-09-24 Certizen representative — Hongkong Post responded to the review questions and said it would update the CPS.
7. 2018-10-22 Fastly representative — Wayne Thayer said a period-of-time EV audit should be obtained and would not delay public discussion for that issue.
8. 2018-11-02 Fastly representative — Wayne Thayer said the draft CPS still lacked all required revocation reasons and asked why Hongkong Post could not publish it.
9. 2018-12-24 Certizen representative — Hongkong Post said it had published a pre-production CPS and provided a period-of-time WebTrust EV SSL report.
10. 2019-01-15 Fastly representative — Wayne Thayer started the public discussion on mozilla.dev.security.policy and summarized the request and review findings.
11. 2019-02-27 Fastly representative — Wayne Thayer recommended approval of the inclusion request.
12. 2019-03-05 Mozilla representative — Mozilla approved the request and said NSS and PSM bugs would be filed for the changes.