Hi Aaron, I tried to track these changes separately, but after merging them into my 3.1 branch I’ve been working from a single branch. To make review easier, here are the separate branches: https://github.com/BenWilson-Mozilla/pkipolicy/branches
Relevant issues are: 291, 292, 293, 294, 295, 298, 299 (not yet merged into 3.1), and this one: https://github.com/BenWilson-Mozilla/pkipolicy/tree/audit-related-issues You should be able to use GitHub’s “Compare” feature to view each branch against MRSP 3.0 directly (the link is found in "This branch is x commits ahead of mozilla/pkipolicy:master"), which may help isolate the changes. Please let me know if generating more specific comparison links would be useful. Thanks, Ben On Fri, Apr 24, 2026 at 1:17 PM Aaron Gable <[email protected]> wrote: > Both of these changes look good to me. It's a bit difficult to isolate > them in the whole-file diff; it would be great if each of these changes > came with its own standalone diff, but I totally understand the difficulty > of disentangling all of that. > > Aaron > > On Thu, Apr 23, 2026 at 3:16 PM 'Ben Wilson' via > [email protected] <[email protected]> wrote: > >> All, >> >> This thread begins discussion of proposed updates to the Mozilla Root >> Store Policy (MRSP) relating to CA operational reporting in a "timely >> manner" (Issue #292 <https://github.com/mozilla/pkipolicy/issues/292>) >> and alignment of the MRSP with external policy frameworks (Issue #293 >> <https://github.com/mozilla/pkipolicy/issues/293>). >> >> These changes are intended to improve clarity and consistency in how CA >> operators meet their reporting obligations, particularly with respect to >> the CCADB, and to better align MRSP requirements with the CCADB Policy and >> the CA/Browser Forum’s requirements documents. The goal is to reduce >> ambiguity, eliminate overlapping or inconsistent requirements, and >> reinforce expectations for CA reporting of accurate and current operational >> data. >> >> Again, here is a comparison >> <https://github.com/mozilla/pkipolicy/compare/3b7d84f5c9708cf6be9655319825d60ea338eca4...ad8e1766be6e0e9a93a64b0b71506ae923086ec5> >> of the proposed MRSP v3.1 >> <https://github.com/BenWilson-Mozilla/pkipolicy/blob/3.1/rootstore/policy.md> >> (working draft, subject to change) vs. the current MRSP v3.0 >> <https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/> >> . >> >> *Overview of Proposed Changes* >> >> *Reporting Obligations and Timeliness – #292 >> <https://github.com/mozilla/pkipolicy/issues/292>* >> >> Section 7.3 (Removals) is updated to replace the existing reference to >> failure to act in a “timely manner” with more explicit language tied to >> CCADB and policy compliance expectations. Under the proposed revision: >> >> “Repeated failure to provide required notifications or updates in the >> CCADB, or to otherwise comply with Mozilla or CCADB Policy requirements for >> maintaining accurate and current information, SHALL be grounds for >> disabling a CA operator’s root certificates or removing them from Mozilla’s >> root store.” >> >> This change is intended to: >> >> - Align the MRSP with the CCADB Policy, which already defines >> expectations for timeliness and data maintenance, and hence avoid >> maintaining separate or potentially inconsistent timing requirements >> within >> the MRSP; and >> - >> >> Emphasize that ongoing accuracy and completeness of operational data >> is a core compliance obligation. >> >> >> *2. Policy Alignment and Order of Precedence – #293 >> <https://github.com/mozilla/pkipolicy/issues/293>* >> >> Clarifications are added to address how the MRSP interacts with other >> applicable requirements, including the CCADB Policy and CA/Browser Forum >> guidelines. >> >> A new sentence in section 2.1 provides an order of precedence. In the >> event of inconsistency between the MRSP and other applicable requirements, >> the MRSP takes precedence. However, where the MRSP does not explicitly >> resolve an inconsistency, then the most restrictive applicable requirement >> applies, unless otherwise specified. >> >> Additionally, where the MRSP had more specific or duplicative text, it >> was removed if the subject was already addressed in the CCADB Policy or >> CA/Browser Forum requirements. >> >> These changes are intended to: >> >> - Provide a clear framework for resolving conflicts across multiple >> governing documents; >> >> >> - Reduce redundancy within the MRSP; and >> >> >> - Rely on external policies where they already define detailed >> operational requirements, while preserving Mozilla’s authority to impose >> stricter or additional requirements where necessary. >> >> >> Feedback on the proposed direction and suggestions on the draft language >> are welcome. >> >> >> >> Thanks, >> >> Ben Wilson >> >> Mozilla Root Program >> >> -- >> You received this message because you are subscribed to the Google Groups >> "[email protected]" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion visit >> https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtab%3Der%3D_eMAS4XPWpG-7yx30YmXpvWtxERaAbAFmoXm%2Bpw%40mail.gmail.com >> <https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtab%3Der%3D_eMAS4XPWpG-7yx30YmXpvWtxERaAbAFmoXm%2Bpw%40mail.gmail.com?utm_medium=email&utm_source=footer> >> . >> > -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtaYqpUhTm4qSZn3%3DhotMJcHwQCBM5mKS00eLDdi%2BgA0S8g%40mail.gmail.com.
