CA/Forbidden or Problematic Practices: Difference between revisions

CA/Forbidden or Problematic Practices (view source)

254 bytes removed , 25 January 2018

Move validation delegation to "forbidden"

Account confirmers, Anti-spam team, Confirmed users, Bureaucrats and Sysops emeriti

4,925

edits

@@ Line 62: / Line 62: @@
 * [https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/ Security Blog Post Regarding SHA-1 Based Signature Algorithms]
-== Potentially Problematic Practices ==
+=== Delegation of Domain / Email Validation to Third Parties ===
+This is forbidden by the Baseline Requirements, section 1.3.2.
-=== Delegation of Domain / Email Validation to Third Parties ===
+Domain and Email validation are core requirements of the [http://www.mozilla.org/projects/security/certs/policy/ Mozilla's Root Store Policy] and should always be incorporated into the issuing CA's procedures. Delegating this function to 3rd parties is not permitted.
-Domain and Email validation are core requirements of the [http://www.mozilla.org/projects/security/certs/policy/ Mozilla's Root Store Policy] and should always be incorporated into the issuing CA's procedures whenever possible. Registration Authorities (RA) or other third parties performing such functions must provide attestations about their procedures and/or should be audited together with the issuing CA. The CA must demonstrate clear and efficient controls attesting the performance of its RAs. Delegation of domain/email validation to third parties should generally be avoided.
+== Potentially Problematic Practices ==
 === Allowing External Entities to Operate Subordinate CAs ===