Mozilla root inclusion review for National Certification Authority of Sri Lanka TLS Root CA - G1 continues after updated test URLs were added
This case is a request to include the National Certification Authority of Sri Lanka TLS Root CA - G1 in the Mozilla Root Store. The CA initially submitted root, hierarchy, audit, CP/CPS, OCSP, CRL, and CT information, and said the root is intended for publicly trusted TLS services. Mozilla’s review raised questions about externally operated subordinate CAs, requested TLS-related materials for websites trust bit enablement, and asked for a Value Statement. The CA replied that the hierarchy was still in a pre-operational phase, with no publicly trusted TLS subordinate CA activated yet and no public TLS issuance operations started at that time. On 2026-09-29, the CA said it had added the required public test URLs to CCADB and that the subordinate CA is now at operational level, asking Mozilla to review the updated information and advise on any remaining requirements. The bug remains open and assigned to Mozilla for further review.
- National Certification Authority of Sri Lanka requested inclusion of its TLS Root CA - G1 in the Mozilla Root Store.
- Mozilla identified missing clarification and additional TLS-related information needed before further inclusion review could proceed.
- The CA said its subordinate CA was not yet operating for publicly trusted TLS issuance and that TLS infrastructure and test websites were not yet operational.
- Mozilla recommended separate purpose-specific roots and hierarchies for different certificate uses.
- The CA said it had added the required public test URLs to CCADB and that the subordinate CA was now at operational level.
- Cert representative — Opened the inclusion request and provided the root certificate, CCADB link, hierarchy details, audit information, CP/CPS, OCSP, CRL, and CT support details.
- Mozilla representative — Said Mozilla’s initial review found items needing clarification, including externally operated subordinate CAs, missing TLS-related materials, and a required Value Statement.
- Cert representative — Explained that the subordinate CA was for document signing only, not publicly trusted TLS issuance, and asked what should be provided during the pre-operational phase.
- Mozilla representative — Recommended that NCA create purpose-specific roots and separate hierarchies for document signing, email, TLS, and other purposes.
- Cert representative — Clarified that the root under review is dedicated to TLS, that no publicly trusted TLS subordinate CA had been activated yet, and asked whether some TLS operational requirements could be submitted later.
- Cert representative — Said NCA had added the required public test URLs to CCADB and requested review of the updated information and next steps.