Hongkong Post e-Cert
Home Contact Us Sitemap 繁體中文 简体中文 Text Mode
A A A


Certizen Limited

Hongkong Post

Level Double-A conformance, W3C WAI Web Content Accessibility Guidelines 2.0
 
 

Date: 1 December 2022

Provision of New Cross-certificate for e-Cert (Server) Subscribers

This is to announce the actions that e-Cert (Server) subscribers have to take to cater for the upcoming expiry of Hongkong Post Root CA1 ("Root CA1") on 15 May 2023.

In 2019, Hongkong Post Certification Authority ("HKPCA") has completed the rollover of Root CA1 to Hongkong Post Root CA3 ("Root CA3") for issuance of e-Cert (Server). At that time, HKPCA has also deployed a cross-certificate ("Existing Cross-Cert") signed by Root CA1 for installation by subscribers on their websites/servers adopting e-Cert (Server) to ensure the accessibility by "older versions of mobile/desktop devices not yet preloaded with Root CA3" ("Older Devices"). Supported platforms that have been included with Root CA3 were highlighted in the previous announcement on 1 April 2022.

To ensure the above accessibility by the Older Devices after the expiry of Root CA1 and the Existing Cross-Cert by 15 May 2023, HKPCA has made ready a new cross-certificate signed by "GlobalSign Root CA - R3" ("New Cross-Cert") in establishing a trust relationship from Root CA 3 to the "GlobalSign Root CA - R3".

GlobalSign is a WebTrust-accredited Certification Authority with its root certificate "GlobalSign Root CA - R3" of validity up to 18 March 2029 trusted by major platforms of Older Devices according to the compatibility information as summarised below:

  • Google Chrome and other supported web browsers on Android 3 or above
  • Microsoft Internet Explorer / Edge and other supported web browsers on Windows XP or above
  • Apple Safari and other supported web browsers on iOS 4 or above, MacOS X 10.6.4 or above
  • Mozilla Firefox version 3.6.12 or above on all supported platforms

Follow-up Actions of e-Cert (Server) Subscribers

All e-Cert (Server) subscribers are required to REPLACE all occurrences of the Existing Cross-Cert with the New Cross-Cert before expiry of Root CA1.

The following deliverables are available for download from HKPCA website.

  1. New Cross-Cert;
  2. User Guide for related installation; and
  3. CPS of e-Cert (Server) updated with information of the New Cross-Cert.

Support Arrangement on the Replacement Service for Existing e-Cert (Server) Certificates

Subscribers are advised to test their websites and system applications with the New Cross-Cert as early as possible. For some subscribers whose existing e-Cert (Server) with validity end date ranging from 1 January to 15 May 2023 (both dates inclusive) and not yet due for renewal, HKPCA will offer them a replacement service for their existing e-Cert (Server).

The support arrangement on the replacement service is summarized as follows:

Period of Request From now until 31 March 2023
Customers Existing e-Cert (Server) subscribers who have e-Cert (Server) with validity end date ranging from 1 January to 15 May 2023 (both dates inclusive)
Support Arrangement Provision of replacement new e-Cert (Server), with free subscription fee within the validity period of the existing e-Cert(Notes).
How-to Apply Call our hotline service 2921 6633 or through email crosscert-support@ecert.gov.hk to check eligibility of offer and arrange replacement.

Notes:

  1. Subscription fee of the replacement e-Cert (Server) will be charged on a pro-rata monthly basis for the period beyond the expiry date of the existing e-Cert (Server). An invoice will be sent to the subscriber directly for the successful application. If no payment is received, we reserve the rights, to suspend the replacement e-Cert (Server) after the expiry date of the existing e-Cert (Server).
  2. The type of the replacement e-Cert (Server) certificate will be consistent with the existing e-Cert (Server) certificate.
  3. The validity period of the replacement e-Cert (Server) will be 1 year from the date of issuance.

Example:

Assuming the validity end date of the current e-Cert (Server) is on 7 March 2023 and the replacement e-Cert (Server) has a validity period from 5 January 2023 to 5 January 2024, the number of remaining months of validity of the replacement e-Cert (Server) would be 9 months 29 days [i.e. 8 March 2023 to 5 January 2024 (both dates inclusive)]. The subscriber will be charged on a pro-rata monthly basis by downward count of a whole number, i.e. 9 months.

For enquiries, please call HKPCA e-Cert Customer Service at 2921 6633 or email to crosscert-support@ecert.gov.hk.