BJCA root inclusion request and CP/CPS review for BJCA Global Root CA1 and CA2
BEIJING CERTIFICATE AUTHORITY Co., Ltd. requested Mozilla Root Store inclusion for BJCA Global Root CA1 and BJCA Global Root CA2, and attached its point-in-time audit report and BR self-assessment. Mozilla reviewed BJCA’s CP/CPS and asked for clarifications and revisions on items including email verification, naming, wildcard validation language, EV address verification, and subscriber agreement/request signature verification. BJCA published updated CP/CPS versions in response, including v1.0.3, v1.0.4, v1.0.6, and later provided additional audit and self-assessment materials. Public discussion started on 2022-11-30, Mozilla later recommended approval, and on 2023-03-16 Mozilla approved inclusion of the two roots with EV enabled. The thread also records a later check of BJCA test websites for the roots, after which BJCA said the sites had been checked and remediated. The bug is resolved as FIXED.
- BJCA requested Mozilla Root Store inclusion for BJCA Global Root CA1 and BJCA Global Root CA2.
- BJCA published BJCA Global CP/CPS v1.0.3 in response to Mozilla comments.
- BJCA published BJCA Global CP/CPS v1.0.6 after further Mozilla review comments.
- Public discussion began for the inclusion request.
- Mozilla approved inclusion of BJCA Global Root CA1 and BJCA Global Root CA2 with EV enabled.
- BJCA said it had checked and remediated the test websites.
- Bjca representative — BJCA opened the case, requested root inclusion, and linked its audit report, BR self-assessment, and CCADB case information.
- Mozilla representative — Mozilla asked BJCA for evidence of its address and said the CPS would need stronger email verification language.
- Bjca representative — BJCA provided address details and said it would revise the CPS based on Mozilla feedback.
- Mozilla representative — Mozilla posted a detailed CPS review with items marked good and items needing fixes.
- Bjca representative — BJCA said it had published BJCA Global CP/CPS v1.0.3 to address Mozilla’s comments.
- Bjca representative — BJCA announced BJCA Global CP/CPS v1.0.4 and said section 4.9.12 now specified how third parties demonstrate private key compromise.
- Bjca representative — BJCA reported completion of its annual WebTrust audit and provided seal links.
- Mozilla representative — Mozilla asked BJCA to provide the current English CP and CPS URLs more directly.
- Mozilla representative — Mozilla said BJCA’s CPS v1.0.3 revisions addressed the review comments and that the matter could proceed to public discussion.
- Mozilla representative — Mozilla announced that public discussion had started and expected to close around 2023-01-11.
- Mozilla representative — Mozilla attached BJCA’s compliance self-assessment and responses to Root Inclusion Considerations.
- Mozilla representative — Mozilla concluded public discussion and recommended approval, starting a one-week last-call period.
- Mozilla representative — Mozilla asked BJCA for reasons not to apply top-level-domain restrictions.
- Bjca representative — BJCA said it hoped not to implement such restrictions and explained its reasons.
- Mozilla representative — Mozilla approved inclusion of BJCA Global Root CA1 and BJCA Global Root CA2 and said NSS and PSM bugs would be filed for the changes.
- Mozilla representative — Mozilla asked BJCA to check test websites because of inconsistent chaining behavior.
- Bjca representative — BJCA said it had checked and remediated the test websites.