Confirmed users, Administrators
5,526
edits
CA:ImprovingRevocation: Difference between revisions
→Preload Revocations of Certain End-Entity Certificates
| Line 169: | Line 169: | ||
* Policy Change: Will need to discuss. | * Policy Change: Will need to discuss. | ||
** | |||
'''When''' To Notify Mozilla: CAs must notify Mozilla of end-entity revocations when an end-entity certificate is revoked due to a technical issue that enabled the certificate to be inappropriately used, such as: | |||
* Wrong Key Usage | |||
* Certificate issued for a domain to somebody that doesn't own/control that domain | |||
'''Time Frame''' for Notification: within 24 hours of revocation of such a certificate | |||
'''How''' to notify Mozilla of a revocation: | |||
* If the revocation is due to a security concern or of revocation of a website certificate whose revocation was not prompted by the certificate owner, send email to security@mozilla.org. | |||
* To notify us of a certificate revocation, submit a bug report into the mozilla.org Bugzilla system, filed against the "CA Certificates" component of the "NSS" product. Whenever possible, the CA should send us the revoked certificate itself, along with the rfc5280 revocation reason code. | |||
* Process Change: To be determined. | * Process Change: To be determined. | ||
=== ''Change Name'' === | === ''Change Name'' === | ||