November 2017 CA Communication

ACTION 5: Perform a BR Self Assessment and send it to Kathleen by January 31, 2018. Your BR Self Assessment must cover your CA Hierarchies (and all of the corresponding CP/CPS documents) that chain up to your CA's root certificates that are included in Mozilla's root store and enabled with the Websites trust bit. Mozilla has added a requirement to our root inclusion/update process that CAs perform a BR Self Assessment. This will continue to be part of our root inclusion/update process. We have found this to be useful for ensuring that CAs are aware of the current CA/Browser Forum's Baseline Requirements. Therefore, we are requesting that each CA perform a BR Self Assessment if they have not already completed one. Our expectation is that CAs will update their processes and documentation to resolve any short-comings that are found during their BR Self Assessment. Mozilla's Root Store Policy requires CAs to review and update their CP/CPS documents at least once every year, and to ensure that they remain fully compliant with the BRs. Therefore, we recommend that you perform a BR Self Self Assessment on a periodic basis. Please indicate your plan to complete your CA's BR Self Assessment.
ACTION 5 COMMENTS Use this space to explain your response regarding performing a BR Self Assessment.

CA Owner Response Response
AC Camerfirma, S.A. We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
Actalis Our BR Self Assessment will be completed by January 31, 2018.
Amazon Trust Services We respectfully request more time to complete our BR Self Assessment - provide date End of Feb 2018. We would prefer to have the Self Assessment completed using our updated CP/CPS.
Asseco Data Systems S.A. (previously Unizeto Certum) Our BR Self Assessment will be completed by January 31, 2018.
Atos Our BR Self Assessment will be completed by January 31, 2018.
Autoridad de Certificacion Firmaprofesional We respectfully request more time to complete our BR Self Assessment - provide date Until Feb/28/2018
Buypass Our BR Self Assessment will be completed by January 31, 2018.
Certicámara Not Applicable, because our root certificates do not have the Websites trust bit enabled. We validated with Mozilla that the BR self assessment does not apply in our case, because we don't issue SSL or TLS server certificates with our own hierarchy of certificates. We are waiting for the inclusion of the new root CA certificate, and it's associated intermediate hierarchy, that were issued because the change to SHA256. We only issue certificates with Email trust bit enabled - Email (S/MIME).
Certinomis / Docapost Our BR Self Assessment will be completed by January 31, 2018.
China Financial Certification Authority (CFCA) Our BR Self Assessment will be completed by January 31, 2018.
Chunghwa Telecom Our BR Self Assessment will be completed by January 31, 2018.
ComSign We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert) Other - explain Consorci AOC will undertake an annual external audit to make sure, among others, that our CP/CPS remain fully compliant with the BRs.
Cybertrust Japan / JCSI Our BR Self Assessment will be completed by January 31, 2018.
D-TRUST Our BR Self Assessment will be completed by January 31, 2018.
Deutscher Sparkassen Verlag GmbH (S-TRUST, DSV-Gruppe) Not Applicable, because our root certificates do not have the Websites trust bit enabled.
Dhimyotis / Certigna We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
DigiCert Our BR Self Assessment will be completed by January 31, 2018.
Disig, a.s. Our BR Self Assessment will be completed by January 31, 2018.
DocuSign (OpenTrust/Keynectis) Other - explain We don't understand if we need to fill in this BR self assessment for all CAs using one self assessment for all or if we need to one assessment per CA. In the second case, this will require a huge work on our side and we will need extra time to do it (around 3 months). In addition, do we have to fill such an assessment for CA that don't issue SSL server certificates even if they could do so (as they are already audited)?
E-Tugra Our BR Self Assessment will be completed by January 31, 2018.
EDICOM We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
Entrust Our BR Self Assessment will be completed by January 31, 2018. Any updates to the CPS documents will be done no later than 31 May 2018 and will be provided to the CCADB with the next audit update.
Global Digital Cybersecurity Authority Co., Ltd. (Formerly Guang Dong Certificate Authority (GDCA)) We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request. We have already submitted our BR Self Assessment to Mozilla via our current root inclusion request.
GlobalSign Our BR Self Assessment will be completed by January 31, 2018.
GoDaddy Our BR Self Assessment will be completed by January 31, 2018.
Google Trust Services LLC (GTS) Our BR Self Assessment will be completed by January 31, 2018.
Government of Hong Kong (SAR), Hongkong Post, Certizen Our BR Self Assessment will be completed by January 31, 2018.
Government of Spain, Autoritat de Certificació de la Comunitat Valenciana (ACCV) We respectfully request more time to complete our BR Self Assessment - provide date Our deadline to complete and send BR Self Assessment is February 28, 2018
Government of Spain, Fábrica Nacional de Moneda y Timbre (FNMT) We respectfully request more time to complete our BR Self Assessment - provide date We expect to provide BR Self Assesment by the end of February 2018.
Government of Taiwan, Government Root Certification Authority (GRCA) We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request. GPKI's BR Self Assessment https://bugzilla.mozilla.org/attachment.cgi?id=8888237
Government of The Netherlands, PKIoverheid (Logius) We respectfully request more time to complete our BR Self Assessment - provide date Seeing that the self-assesment coincides with the holiday period and also with the half-yearly CP revision Logius PKIoverheid expects that said assessment and any resulting work to our CP/CPS will take more time. We kindly request the deadline to be extended till April 1
Government of Turkey, Kamu Sertifikasyon Merkezi (Kamu SM) Our BR Self Assessment will be completed by January 31, 2018.
HARICA We respectfully request more time to complete our BR Self Assessment - provide date We will be able to provide the BR Self Assessment by the end of February 2018.
IdenTrust Services, LLC Our BR Self Assessment will be completed by January 31, 2018.
Internet Security Research Group (ISRG) Our BR Self Assessment will be completed by January 31, 2018.
Izenpe S.A. Our BR Self Assessment will be completed by January 31, 2018.
Krajowa Izba Rozliczeniowa S.A. (KIR) We respectfully request more time to complete our BR Self Assessment - provide date Our deadline to complete and send BR Self Assessment is March 1, 2018
LuxTrust Our BR Self Assessment will be completed by January 31, 2018.
Microsec Ltd. Our BR Self Assessment will be completed by January 31, 2018.
NetLock Ltd. Our BR Self Assessment will be completed by January 31, 2018.
QuoVadis Our BR Self Assessment will be completed by January 31, 2018.
SECOM Trust Systems CO., LTD. Our BR Self Assessment will be completed by January 31, 2018.
SK ID Solutions AS Other - explain Please note that as of 1 September 2017, SK ID Solutions no longer issues TLS Server Certificates. Therefore, we are of respectful opinion that requirement to perform BR Self Assessment is not applicable to us. However, should it be otherwise, we kindly ask Mozilla to inform us. If required to perform the assessment, SK shall do it as soon as possible.
SSL.com We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
Sectigo Our BR Self Assessment will be completed by January 31, 2018.
SecureTrust Our BR Self Assessment will be completed by January 31, 2018.
SwissSign AG We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request.
Swisscom (Switzerland) Ltd Not Applicable, because our root certificates do not have the Websites trust bit enabled.
T-Systems International GmbH (Deutsche Telekom) We respectfully request more time to complete our BR Self Assessment - provide date Our BR Self Assessment will be completed by 04/15/2018.
Taiwan-CA Inc. (TWCA) Our BR Self Assessment will be completed by January 31, 2018.
Telia Company (formerly TeliaSonera) We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request. Telia already did BR self-assessment related to EV update request in September 28, 2017 (https://bugzilla.mozilla.org/show_bug.cgi?id=1322668). We are still waiting for Mozilla to process our request.
TrustCor Systems Our BR Self Assessment will be completed by January 31, 2018.
Trustis We respectfully request more time to complete our BR Self Assessment - provide date 02/28/2018 - Trustis (and the Root CA) have recently been acquired by Entrust Datacard. This change of ownership and management may delay the submission of the BR Seflf-assessment due to management review of the Root CA Services.
TurkTrust Our BR Self Assessment will be completed by January 31, 2018.
Visa Our BR Self Assessment will be completed by January 31, 2018.
WISeKey We have already submitted our BR Self Assessment to Mozilla via our current root inclusion/update request. We recently requested a new Root to be included in the CCADB, we supplied our latest BR Self Assessment during this process.
Web.com We respectfully request more time to complete our BR Self Assessment - provide date We kindly request an extension until April 1, 2018 to submit the BR Self Assesssment, Please be aware that we are currently working to ensure we accomplish the necessary update of process and documentation by a target date of March 15, 2018.
certSIGN Our BR Self Assessment will be completed by January 31, 2018.