PostSignum root inclusion and compliance review for Root QCA 4 and Root QCA ECC R1

This case concerns PostSignum’s request to add PostSignum Root QCA 4 and PostSignum Root QCA ECC R1 to Mozilla’s root program. The thread began with PostSignum providing the root certificate information and Mozilla directing the CA to complete the inclusion checklist and, if requesting the Websites trust bit, a BR self-assessment. Mozilla then reviewed audit and CCADB requirements, including audit statement hosting, NAB accreditation evidence, and later CCADB case tracking for the two roots. The thread also includes a separate compliance review of PostSignum’s TLS issuance practices, where Mozilla identified certificate profile and OCSP issues and later reviewed a compliance self-assessment and CPS updates. In 2025–2026, Mozilla clarified that the inclusion request for Root QCA 4 and Root QCA ECC R1 was limited to the email trust bit, and in May 2026 noted that CCADB Case 1726 was missing the PostSignum Root QCA ECC R1 under the Mozilla tab. The current thread status remains ASSIGNED, with PostSignum continuing to work through the inclusion and compliance items.

1. 2019-12-09 PostSignum opened a request to add Root QCA 4 and Root QCA ECC R1.
2. 2020-10-15 PostSignum provided the required NAB confirmation for TayllorCox accreditation.
3. 2021-02-20 Mozilla identified multiple TLS certificate issuance and linting issues under PostSignum Public CA 5.
4. 2022-08-23 PostSignum attached a compliance self-assessment and published an updated CP/CPS.
5. 2025-04-15 Mozilla stated the inclusion request was tracked in CCADB cases 526 and 1726 and limited to the email trust bit.
6. 2026-05-27 Mozilla noted CCADB Case 1726 was missing PostSignum Root QCA ECC R1 under the Mozilla tab.

1. 2019-12-09 Cpost representative — PostSignum opened the bug and linked the Root QCA 4 certificate.
2. 2019-12-11 Mozilla representative — Mozilla asked PostSignum to complete the inclusion checklist and, if requesting Websites trust, a BR self-assessment.
3. 2020-08-27 Mozilla representative — Mozilla identified audit verification issues involving the audit report hosting location and NAB accreditation wording.
4. 2020-10-15 Cpost representative — PostSignum uploaded the NAB confirmation document.
5. 2020-10-16 Mozilla representative — Mozilla said the TayllorCox accreditation was updated and requested a BR self-assessment and updated CP/CPS for Websites trust.
6. 2021-02-20 Mozilla representative — Mozilla asked PostSignum to review and correct multiple TLS certificate issuance errors and revocations.
7. 2021-02-24 Cpost representative — PostSignum said it was replacing certificates gradually and had revoked one internal-server-name certificate.
8. 2021-09-22 Mozilla representative — Mozilla requested a Compliance Self-Assessment and an updated CPS.
9. 2022-08-23 Cpost representative — PostSignum attached a compliance self-assessment and said its CP/CPS had been published.
10. 2024-07-19 Mozilla representative — Mozilla provided additional comments on the PostSignum CPS review.
11. 2024-07-26 Cpost representative — PostSignum replied with edits made to the CP draft and linked the repository.
12. 2025-04-15 Mozilla representative — Mozilla clarified that the inclusion request was tracked in CCADB cases 526 and 1726 and limited to the email trust bit.
13. 2026-02-27 Cpost representative — PostSignum said issuance of certificates with longer Organization Name had been stopped until the situation was clarified.
14. 2026-02-28 Mozilla representative — Mozilla restated that the Organization Name limit is 64 characters and that longer certificates are non-compliant.
15. 2026-03-02 Cpost representative — PostSignum said it had suspended issuance of TLS certificates for companies whose names exceed 64 characters.
16. 2026-05-27 Mozilla representative — Mozilla noted CCADB Case 1726 was missing the PostSignum Root QCA ECC R1 under the Mozilla tab.