NSS:CAInclusionProcessIssues

This page was created so people can add and track progress of resolving issues/concerns with Mozilla's current CA Inclusion Process.

Issues currently being worked on

As Mozilla's CA Certificate Policy is updated, CAs with root certs included in NSS are given a time frame to come into compliance with the new rules. The new rules are also applied to CAs with requests in the queue for discussion.

Here are issues with Mozilla's CA Inclusion Process that are currently being worked on, and the actions that are being taken.

Accountability of sub-CAs

• Draft update to the Mozilla CA Certificate Policy in progress to require subCAs to either be technically constrained or be audited according to Mozilla's CA Certificate Policy.
• CAs requesting root inclusion or updates have to provide the information in the Checklist for Subordinate CAs

The current WebTrust and ETSI audits don't sufficiently check network security protections.

• CA Communication sent to CAs in September. The action items for already included CAs are being tracked to completion. All CAs with requests in the queue for discussion must appropriately respond to that communication and provide further information in those areas before their inclusion request may enter public discussion.
• Updating Mozilla's CA Certificate Policy to add a requirement for CAs to comply with the CA/Browser Forum’s Baseline Requirements, and be audited to those criteria. In particular, BR 16 addresses data security, risk assessment, security, plan, system security, and private key protection. This is currently in discussion in m.d.s.policy. CAB Forum is working to have audits include the BRs by the end of 2012.

Issues that need to be addressed

The following are issues with Mozilla's CA Inclusion Process that people would like to have addressed.

• CA requests sit in the Queue for Public Discussion for up to a year. The process is too serial in nature, and requests like updating roots already in NSS should be given priority.