HARICA request to add the Hellenic Academic and Research Institutions RootCA 2011 root certificate

HARICA opened this case to request Mozilla inclusion of its root certificate, initially describing the Hellenic Academic and Research Institutions RootCA 2006 and later updating the request to the Hellenic Academic and Research Institutions RootCA 2011. The thread records Mozilla’s information-gathering and verification process, including requests for audit evidence, CP/CPS updates, and confirmation of CRL/OCSP support. HARICA provided audit reports, updated its CP/CPS, enabled OCSP for the new hierarchy, and later implemented name constraints after discussion in the Mozilla security policy mailing list. Mozilla then opened public discussion and, after the discussion period ended, approved inclusion of the Hellenic Academic and Research Institutions RootCA 2011 for websites, email, and code. The bug was later marked resolved, and the NSS follow-up bug was filed separately as bug 711594.

1. 2010-07-26 HARICA requested Mozilla inclusion of its root certificate hierarchy.
2. 2011-04-12 HARICA reported completion of an ETSI TS 101 456 audit and CP/CPS updates.
3. 2011-05-02 HARICA enabled OCSP support for https://www2.harica.gr under the new SHA1 root CA.
4. 2011-11-23 HARICA implemented the name constraints extension for the new root.
5. 2011-12-16 Mozilla approved inclusion of the Hellenic Academic and Research Institutions RootCA 2011 root certificate.

1. 2010-07-26 HARICA — HARICA requested addition of its root certificate and described its PKI, audit plans, and certificate usage.
2. 2010-07-28 Mozilla representative — Mozilla accepted the bug and began the information-gathering and verification phase.
3. 2011-04-12 HARICA — HARICA said it had completed an ETSI TS 101 456 audit and updated its CP/CPS.
4. 2011-04-12 Mozilla representative — Mozilla asked whether CRL and OCSP support had been implemented for the new root.
5. 2011-05-02 HARICA — HARICA said OCSP support had been enabled for https://www2.harica.gr under the new SHA1 root CA.
6. 2011-09-13 HARICA — HARICA responded to Mozilla’s security questions about audits, cross-signing, MFA, domain restrictions, and third-party subordinate CAs.
7. 2011-10-25 HARICA — HARICA said the OCSP daemon issue had been fixed and confirmed the information in the gathering document was current and correct.
8. 2011-10-25 Mozilla representative — Mozilla opened the first public discussion period for the request to add the Hellenic Academic and Research Institutions RootCA 2011 root certificate and enable all three trust bits.
9. 2011-11-23 HARICA — HARICA reported that it had implemented the name constraints extension and updated the CP/CPS.
10. 2011-12-13 Mozilla representative — Mozilla summarized the assessment after public comment, including validation, hierarchy, and audit findings.
11. 2011-12-16 Mozilla representative — Mozilla approved inclusion of the Hellenic Academic and Research Institutions RootCA 2011 root certificate.
12. 2012-03-06 Mozilla representative — Mozilla noted that the root certificate was a Builtin Object Token in Firefox 11.