Hongkong Post Root CA 1 inclusion request for SSL trust

This case is Hongkong Post’s request to add the Hongkong Post Root CA 1 certificate to Mozilla’s trusted root store with SSL trust enabled. The request was opened by Stephen Choy of Hongkong Post in December 2007 and later accepted by Mozilla for review. During information gathering, Mozilla asked about the certificate hierarchy, outsourcing, and CRL behavior; Hongkong Post clarified that the root and its subordinate CA services were operated by E-Mice Solutions and that the request was for SSL trust only. Mozilla initially held the request pending CRL-related concerns, including that the full CRL was not discoverable via CRLDP and that the CRL nextUpdate period was one month. Hongkong Post later said it would change the server certificate CRLDP to the full CRL and set nextUpdate to 10 days, and Mozilla confirmed those action items were completed. Mozilla then filed bug 541499 against NSS for the actual inclusion changes, and the bug was marked RESOLVED FIXED.

1. 2007-12-19 Hongkong Post requested inclusion of Hongkong Post Root CA 1 with SSL trust enabled.
2. 2009-02-25 Mozilla completed its assessment and recommended approval for SSL use only.
3. 2010-01-22 Mozilla confirmed the CRL-related action items were completed and filed the NSS implementation bug 541499.

1. 2007-12-19 Hkpo representative — Hongkong Post opened the request to include Hongkong Post Root CA 1 and enable SSL trust.
2. 2008-09-23 Mozilla representative — Mozilla began information gathering on the root, hierarchy, outsourcing, and testing details.
3. 2008-09-29 Hkpo representative — Hongkong Post clarified the hierarchy, said E-Mice operated the services, and stated the email trust bit was intended if policy allowed.
4. 2008-10-08 Hkpo representative — Hongkong Post asked Mozilla to proceed with enabling the SSL trust bit only.
5. 2008-10-22 Mozilla representative — Mozilla said the request was ready for public discussion but noted the CRL issue and asked whether the critical CRLDP flag could be removed.
6. 2009-02-25 Mozilla representative — Mozilla summarized the assessment and recommended approval for Hongkong Post Root CA 1 with websites trust only.
7. 2009-03-04 Hecker representative — Mozilla approved the request subject to the caveat that the full CRL must be discoverable via CRLDP before future CRLDP support.
8. 2010-01-22 Mozilla representative — Mozilla confirmed both CRL-related action items were completed and said it would create the NSS bug for inclusion.
9. 2010-01-22 Mozilla representative — Bug 541499 was filed against NSS for the actual changes.