Confirmed users, Administrators
5,526
edits
CA/CertificatePolicyV2.1: Difference between revisions
Jump to navigation
Jump to search
→Time Frames for included CAs to comply with the new policy
| Line 9: | Line 9: | ||
== Time Frames for included CAs to comply with the new policy == | == Time Frames for included CAs to comply with the new policy == | ||
Version 2.1 of [http://www.mozilla.org/projects/security/certs/policy Mozilla's CA Certificate Policy] was published on February 14, 2013. | |||
Certificates issued before February 15, 2013, must at least meet the requirements of [http://www.mozilla.org/projects/security/certs/policy/ Version 2.0 of Mozilla's CA Certificate Policy.] | |||
Any Certificate Authority requesting root inclusion after February 15, 2013 must comply with [http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/ Version 2.1 of Mozilla's CA Certificate Policy.] | |||
CAs that were already included in Mozilla's program as of February 15, 2013 shall comply with version 2.1 of the [http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/InclusionPolicy.html Inclusion Policy] as follows. Audits performed after the dates listed below should confirm the CA's compliance with the new policy. | |||
=== Audit Criteria === | |||
[http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/ Version 2.1 of Mozilla's CA Certificate Policy] adds the requirement that SSL certificate issuance also be audited according to the CA/Browser Forum's Baseline Requirements. CAs with a root certificate that has the websites (SSL/TLS) trust bit enabled in Mozilla's CA Certificate Program shall have their SSL certificate issuance and operations audited according to the Baseline Requirements between February 15, 2013, and February 15, 2014. | |||
Audits performed for audit periods commencing before February 15, 2013, must be performed at least according to the criteria listed in [http://www.mozilla.org/projects/security/certs/policy/ Version 2.0 of Mozilla's CA Certificate Policy.] Additionally, if SSL certificates are issued, audits performed for audit periods commencing before February 15, 2013, must also be performed according to the Baseline Requirements audit criteria (WebTrust SSL Baseline Requirements Audit Criteria V.1.1, or ETSI TS 102 042 V2.3.1 DVCP and OVCP) as to CA operations occurring on or after February 15, 2013. If the Baseline Requirements audit would only apply to 120 days or less, then a Point in Time audit may be performed. At the CA's option, the Baseline Requirements audit may cover the entire audit period. | |||
Audits performed for audit periods commencing on or after February 15, 2013, must be performed according to the criteria listed in [http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/ Version 2.1 of Mozilla's CA Certificate Policy] as to all CA operations during the audit period. | |||
=== Multi-Factor Authentication and CA Hierarchy === | |||
Item #6, third bullet: The multi-factor authentication requirement was previously communicated to all CAs, so all CAs are expected to already be in compliance with this requirement. | |||
Item #6, fourth bullet: "maintain a certificate hierarchy such that the included certificate does not directly issue end-entity certificates to customers (e.g., the included certificate signs intermediate issuing certificates), as described in CA/Browser Forum Baseline Requirement #12;" | |||
* This requirement and the exceptions listed in BR #12 apply to SSL/TLS, S/MIME, and Code Signing certificates. | |||
* Root certificates and trust anchors that are already included in NSS will be granted the time necessary to transition their existing customers to a new hierarchy. If needed, the CA shall create a new root certificate within the next year (before February 2014) and actively work to include the new root certificate in Mozilla's program and transition their customers to the new hierarchy. | |||
* Mozilla grants an exception to the trust anchors in Mozilla's program that are signed by national policy root certificates whose corresponding national policy does not allow the subordinate CA to issue other subordinate CA certificates. | |||
=== Technical Constraints or Auditing/Disclosure of Intermediate Certificates === | |||
Items #8, 9, and 10 of the [http://www.mozilla.org/projects/security/certs/policy/InclusionPolicy.html Inclusion Policy] describe how intermediate certificates must either be technically constrained '''or''' audited and disclosed. | |||
* All subordinate CA certificates that are issued after May 15, 2013 must comply with version 2.1 of the [http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/InclusionPolicy.html Inclusion Policy] | |||
* All pre-existing subordinate CA certificates must be updated to comply with version 2.1 of the [http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/InclusionPolicy.html Inclusion Policy] for new certificate issuance by May 15, 2014. | |||
* All certificates that are capable of being used to issue new certificates must comply with version 2.1 of the [http://www.mozilla.org/projects/security/certs/policy/InclusionPolicy.html Inclusion Policy] for new certificate issuance by May 15, 2014. | |||
=== Baseline Requirements === | |||
Item #12 adds the requirement for CA operations and issuance of certificates to be used for SSL-enabled servers to also conform to version 1.1 of the CA/Browser Forum Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates. | |||
* As of February 2013, SSL certificate issuance must also be audited according to the Baseline Requirements (BRs), as described above. The first BR audit for each CA and subCA may include a list of BRs that the CA (or subCA) is not yet in compliance with. The second BR audit (the following year) is expected to confirm that the issues that were listed in the previous BR audit have been resolved. | |||
* All other dates are as specified by the CA/Browser Forum. | |||
== Frequently Asked Questions == | == Frequently Asked Questions == | ||