All, I have reviewed the open issues in the mozilla/pkipolicy repository and identified a set of items to address in the next version (v. 3.1) of the Mozilla Root Store Policy (MRSP). These are currently labeled for the upcoming update:
https://github.com/mozilla/pkipolicy/issues?q=is%3Aissue%20state%3Aopen%20label%3A3.1 The current set of issues proposed for inclusion in v.3.1 is: Issue # Description #298 Clarify MRSP 7.1 audit requirements for inclusion requests #297 Update version number references for audit criteria #296 Add possibility of requesting a Detailed Controls Report as MRSP 3.1.5 #295 Revise Item 1 in MRSP 3.3 #294 Require Root CA Key Generation within Last 5 Years #293 Remove redundancy between MRSP and CCADB Policy and BRs #292 Refine what a "timely manner" means in MRSP 7.3 #291 Clarify MRSP 8.1 re: CA Acquisitions #282 Consider requiring Markdown/AsciiDoc for CPs and CPSes Rather than addressing each issue independently, I plan to organize discussion into four (4) themed threads by grouping related issues together, to keep conversations focused and productive, in the following order: *1. CP/CPS Documentation Requirements* (#295, #282) Focus: sufficiency of disclosure, incorporation by reference, and documentation format. *2. Audits, Assurance, and Root Inclusion Requirements* (#296, #297, #298, #294) Focus: audit expectations, Detailed Controls Reports (DCRs), and requirements tied to root inclusion (including root key age). *3. CA Operational Reporting and Policy Alignment* (#292, #293) Focus: timeliness of updates, and alignment with CCADB Policy and CA/Browser Forum requirements. *4. Governance and CA Ownership Changes* (#291) Focus: evaluation of CA acquisitions and changes in control. If there are additional issues that should be included, or if any of the above should be re-scoped or reprioritized, please respond here. Thanks, Ben Mozilla Root Program -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtaZuQUwomKKBngsMYkUnTXcqKQ7GH_kxXKrwoTP%2BK0-QXQ%40mail.gmail.com.
