HARICA: Transition Plan for Existing Dual-Purpose Roots
This case tracks HARICA’s preliminary transition plan for two HARICA 2015 root CAs: “Hellenic Academic and Research Institutions ECC RootCA 2015” and “Hellenic Academic and Research Institutions RootCA 2015.” The roots are currently included in NSS with both Websites (TLS) and Email (S/MIME) trust bits enabled. HARICA submitted the plan in response to MRSP §7.5.3 (dual-purpose root transition requirement) and MRSP §7.4 / the Root CA Lifecycle Transition Schedule for trust-bit removal and root removal based on key generation date. HARICA reports that since 2021, most TLS and S/MIME issuance has migrated to dedicated 2021 hierarchies, while the 2015 hierarchy remains present for legacy compatibility considerations. The proposed plan sets Websites (TLS) distrust_after_date to April 15, 2027, S/MIME distrust_after_date to April 15, 2028, and complete root removal from NSS to April 15, 2030. The bug is intended to remain open to track implementation steps and any necessary NSS changes.
- HARICA generated the key pairs for the HARICA 2015 root hierarchy.
- The HARICA 2015 roots were added to NSS.
- HARICA migrated most TLS and S/MIME issuance to dedicated 2021 hierarchies.
- HARICA’s preliminary transition plan for the dual-purpose 2015 roots was submitted in this bug.
- Mozilla representative — Ben Wilson posted HARICA’s preliminary transition plan, including the MRSP triggers and the proposed distrust_after_date and removal dates for the two 2015 roots.