PostSignum request to add Root QCA 4 and Root QCA ECC R1, with ongoing Mozilla review of inclusion prerequisites
This case is PostSignum’s request to add the PostSignum Root QCA 4 and PostSignum Root QCA ECC R1 roots to Mozilla’s CA program. Mozilla initially directed PostSignum to complete the root inclusion checklist and, if Websites trust was requested, to provide a BR self-assessment and updated CP/CPS materials. The thread later included Mozilla review of audit-verification items, certificate-profile and OCSP issues, and CPS/self-assessment updates, which were discussed in the context of the inclusion review. In April 2025, Mozilla stated that the inclusion request was being tracked in CCADB Case 526 for PostSignum Root QCA 4 and CCADB Case 1726 for PostSignum Root QCA ECC R1, and that both requests would be limited to the email trust bit. In February and March 2026, the thread also revisited Mozilla’s earlier position that organizationName values over 64 characters are non-compliant, and PostSignum said it had suspended issuance of TLS certificates for companies whose names exceed 64 characters. In May 2026, Mozilla said CCADB Case 1726 was missing the ECC root under the Mozilla tab. In August 2026, PostSignum replied that Case 1726 could not be edited because it was submitted for review, and that a new CCADB case, 00003381, had been created. The bug remains open and assigned, with inclusion work still dependent on the related CCADB case handling and Mozilla’s ongoing review.
- PostSignum opened a request to add PostSignum Root QCA 4 and PostSignum Root QCA ECC R1.
- PostSignum provided a Czech NAB confirmation document regarding TayllorCox accreditation.
- Mozilla identified multiple TLS certificate-profile issues under PostSignum Public CA 5 and asked for correction by revocation and replacement.
- PostSignum attached a compliance self-assessment and said its CP/CPS had been published.
- Mozilla said the inclusion requests were limited to the email trust bit and tracked in CCADB Cases 526 and 1726.
- PostSignum said it had stopped issuing certificates with longer Organization Name values until the situation was clarified.
- PostSignum said it had suspended issuance of TLS certificates for companies whose names exceed 64 characters.
- Mozilla said CCADB Case 1726 was missing PostSignum Root QCA ECC R1 under the Mozilla tab.
- PostSignum said CCADB Case 1726 could not be edited and that it created new CCADB Case 00003381.
- Cpost representative — PostSignum opened the bug and linked the Root QCA 4 certificate.
- Mozilla representative — Mozilla asked PostSignum to complete the inclusion checklist and a BR self-assessment if Websites trust would be requested.
- Mozilla representative — Mozilla identified audit verification issues involving audit report hosting and NAB accreditation wording.
- Cpost representative — PostSignum attached the requested NAB confirmation document.
- Mozilla representative — Mozilla said the accreditation information had been updated and requested a BR self-assessment and updated CP/CPS for Websites trust.
- Mozilla representative — Mozilla asked PostSignum to review and correct multiple TLS certificate issuance errors by revoking and replacing affected certificates.
- Mozilla representative — Mozilla reported OCSP warnings and errors from a PostSignum test website.
- Cpost representative — PostSignum said certificates were being replaced gradually, one internal-server-name certificate had been revoked, and it disputed some of Mozilla’s interpretations.
- Mozilla representative — Mozilla requested a Compliance Self-Assessment attachment and an updated CPS meeting Mozilla policy requirements.
- Mozilla representative — Mozilla reiterated that organizationName is limited to 64 characters and said certificates exceeding that limit would need to be revoked.
- Mozilla representative — Mozilla said it believed PostSignum’s responses in comment 22 were satisfactory explanations and raised the priority to P3.
- Cpost representative — PostSignum attached a compliance self-assessment and said its CP/CPS had been published.
- Mozilla representative — Mozilla posted additional CPS review comments and recommendations.
- Cpost representative — PostSignum replied to the CPS review comments, described edits, and linked its repository.
- Mozilla representative — Mozilla clarified that the inclusion requests were limited to the email trust bit and tracked in CCADB Cases 526 and 1726.
- Community commenter — A commenter asked Mozilla to confirm that earlier comments had not authorized PostSignum to continue issuing certificates with organizationName values over 64 characters.
- Cpost representative — PostSignum said it had stopped issuing certificates with longer Organization Name values until the matter was clarified.
- Mozilla representative — Mozilla restated that its prior comments did not authorize continued issuance and that the 64-character organizationName limit applies.
- Cpost representative — PostSignum said it had suspended issuance of TLS certificates for companies whose names exceed 64 characters.
- Sectigo — A commenter said standards must be followed and that if a company name cannot fit within the BR rules, the CA should not issue the certificate.
- Mozilla representative — Mozilla said CCADB Case 1726 was missing the ECC root under the Mozilla tab and needed the Add/Select Root Certificates step.
- Cpost representative — PostSignum said Case 1726 could not be edited because it was submitted for review and that new CCADB Case 00003381 had been created.