CA: Difference between revisions

= Mozilla's CA Certificate Program =

Mozilla’s CA Certificate Program governs inclusion of root [https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates certificates] in [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS Network Security Services (NSS),] a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products. The program is overseen by the module owner and peers of the [[Modules/Activities#CA_Certificates|CA Certificates Module]];  the policy itself is overseen by the module owner and peers of the [[Modules/Activities#Mozilla_CA_Certificate_Policy|CA Certificate Policy Module]].

== Policy ==

== Lists of CAs and Certificates ==

* [https://www.ccadb.org/rootstores/usage#ccadb-data-usage-terms Data Usage Terms]

* [[CA/Included_CAs|Included CAs]] (in the Root Program and in Firefox)

* [[CA/Included_Certificates|Included CA Certificates]]

* [[CA/Intermediate_Certificates|Intermediate Certificates]]

* [[CA/Removed_Certificates|Removed CA Certificates]]

* [[NSS:Release_Versions|NSS Release Versions]] - shows in which version of Mozilla products each root certificate was first available

* [[CA/Additional_Trust_Changes| Additional Trust Policies ]] - describes trust policies enforced by PSM in Firefox and Thunderbird, but not represented in the NSS root store.

== Program Administration ==

Most information relating to the administration of our program is stored either in [https://bugzilla.mozilla.org/ Bugzilla] or in the [https://ccadb.org/ Common CA Database].

* [[CA/Dashboard|Certificate Change Request Dashboard]] - tracks applications and trust changes through the process in Bugzilla

** [[CA/Prioritization|Certificate Change Prioritization]]  

* [[CA/Certificate_Change_Requests|Certificate Change Requests]] as tracked in the CCADB

* [[CA/Incident_Dashboard|Incident and Compliance Dashboard]]

** [[CA/Maintenance_and_Enforcement#Issues_Lists|CA Issues Lists]]

* [[CA/CCADB_Dashboard|CCADB Dashboard]]

* [[CA/Bug_Triage|Bugzilla Bug Triage Process]] - also lists whiteboard tags

* [[CA/Email_templates|Email Templates used by CCADB]]

====crt.sh====

* [https://crt.sh/mozilla-disclosures Disclosure status of all certificates known to CT]

* [[CA/Audit_Statements|Audit_Statements]]

** [[CA/Quantifying_Value|Quantifying Value: Information Expected of New Applicants]]

** [[CA/Information_Checklist|CA Information Checklist]]

* [[CA/Root_Inclusion_Considerations|Root Inclusion Considerations]] -- This page is intended to be used as a tool for identifying when a CA Operator's root inclusion request should be denied, or when a CA's root certificate should be removed from Mozilla's root store.

 

* [https://github.com/certlint/certlint BR Lint Certificate Test] - source code download

* [https://github.com/zmap/zlint ZLint - Certificate Test of Mozilla's and others' requirements] - source code download

* [https://github.com/kroeckx/x509lint X.509 Lint Certificate Test] - source code download

* [[CA:TestErrors|Common Test Errors]]

 

* [[CA/Auditor_Mistakes|Mistakes we have seen auditors make]] and their consequences

 

== Information for the Public ==

* [[CA/FAQ|FAQ About Certificates and CAs]]

* [https://bugzilla.mozilla.org/enter_bug.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance Report an Incident to Mozilla] (be sure to click the "Security" checkbox if it is a [https://www.mozilla.org/en-US/security/#For_Developers security-sensitive incident])

* [[CA/Changing_Trust_Settings|Changing Certificate Trust Settings in Firefox]]

* [https://observatory.mozilla.org/ Mozilla SSL Server Quality Checker]

* [[CA/AddRootToFirefox|How to install your own root certificate in Firefox]]

 

 

 

* '''[https://groups.google.com/a/ccadb.org/g/public CCADB Public mailing list''' is used to conduct a six-week public discussion of CA root inclusion requests and to discuss important lessons learned from CA incident reports. See https://www.ccadb.org/cas/public-group for more information.

 

* '''[https://groups.google.com/a/mozilla.org/g/dev-security-policy Mozilla's dev-security-policy (MDSP)] mailing list''' is used for discussions of Mozilla policies related to security in general and CAs in particular, and for wider discussions about the WebPKI. If you are a regular participant in MDSP, then please add your name to the [[CA/Policy_Participants|Policy Participants]] page.

 

 

 

 

 

 

(RSS): https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/maillist.xml

 

* [https://groups.google.com/a/mozilla.org/g/dev-tech-crypto Mozilla's dev-tech-crypto] mailing list is used for discussions of the [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS NSS] cryptographic library used in Firefox and other Mozilla-based products, as well as the [https://www.mozilla.org/projects/security/pki/psm/ PSM] module that implements higher-level security protocols for Firefox.

** [https://discourse.mozilla.org/tags/c/firefox-development/privacy-and-security Mozilla's privacy-and-security forum] is a place to discuss issues and questions specific to privacy and security.

** [https://chat.mozilla.org/#/room/#security:mozilla.org chat on Matrix] may also be used