View source for CA/Intermediate Certificates

= Intermediate Certificates =

[[CA/Included_Certificates|CAs]] are required to provide the data for all of their [[CA:SalesforceCommunity#Which_intermediate_certificate_data_should_CAs_add_to_Salesforce.3F|publicly disclosed and audited intermediate certificates]] which chain up to root certificates in Mozilla's program. They do this using the [[CA:SalesforceCommunity|CCADB]]. 

The following reports are '''generated once per day''' and include valid intermediates and expired intermediates but not revoked intermediates:

* [https://ccadb-public.secure.force.com/mozilla/PublicAllIntermediateCerts Intermediate CA Certificates] (HTML)
* [https://ccadb-public.secure.force.com/mozilla/PublicAllIntermediateCertsCSV Intermediate CA Certificates] (CSV)
* [https://ccadb-public.secure.force.com/mozilla/PublicAllIntermediateCertsWithPEMCSV Intermediate CA Certificates] (CSV with PEM of raw certificate data)

The following reports list revoked intermediates:

* [https://ccadb-public.secure.force.com/mozilla/PublicIntermediateCertsRevoked Revoked Intermediate CA Certificates] (HTML)
* [https://ccadb-public.secure.force.com/mozilla/PublicIntermediateCertsRevokedCSVFormat Revoked Intermediate CA Certificates] (CSV)
* [https://ccadb-public.secure.force.com/mozilla/PublicIntermediateCertsRevokedWithPEMCSV Revoked Intermediate CA Certificates] (CSV with PEM of raw certificate data)

The following reports list the intermediate certs that are ready to be added to OneCRL. Some non-revoked intermediate certs are added to OneCRL because they are not intended to be used for SSL/TLS.
* [https://ccadb-public.secure.force.com/mozilla/PublicInterCertsReadyToAddToOneCRL Intermediate CA Certificates Ready to Add to OneCRL] (HTML)
* [https://ccadb-public.secure.force.com/mozilla/PublicInterCertsReadyToAddToOneCRLPEMCSV Intermediate CA Certificates Ready to Add to OneCRL] (CSV with PEM  of raw certificate data)

Firefox (version 37 and later) uses the [https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ OneCRL] system, which pushes a list of revoked certificates to the browser. It includes (or should include) all the revoked intermediates in the above report.

* [https://firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/certificates/records OneCRL Raw Data]
* [https://crt.sh/mozilla-onecrl OneCRL data table with links to each certificate in crt.sh and the corresponding Bugzilla bugs]