CA

Mozilla's CA Certificate Program

Mozilla’s CA Certificate Program governs inclusion of root certificates in Network Security Services (NSS), a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products.

Policy

• Root Store Policy (current stable version: 2.4.1)
• CA Communications and their responses. Such communications may also set policy in advance of it being included in the Root Store Policy.
• Process for updating the Root Store Policy
  • Root Store Policy Issue Tracker
  • Latest draft of Root Store Policy (will become the next version)
• Root Store Policy Archive
• Root Transfer Policy: Mozilla's expectations when the ownership of an included root certificate changes, the organization operating the PKI changes, and/or the private keys of the root certificate are transferred to a new location.

Lists of Certificates

• Included CA Certificates
• NSS:Release_Versions - shows which version of Mozilla products a particular root certificate was first available in
• Removed CA Certificates
• Certificate Change Requests
• Intermediate Certificates
• Revoked Intermediate Certificates

Program Administration

Most information relating to the administration of our program is stored either in Bugzilla or in the Common CA Database.

• Certificate Change Request Dashboard - tracks applications and trust changes through the process
• Lists of Mis-issuance Incident and Compliance Bugs
• How we mark Bugzilla bugs related to the CA Certificate program

Information for CAs

• Application Process Overview
• How To Apply
• Making Changes to Included Roots

• Recommended CA practices
• Potentially problematic CA practices
• How to do a self-assessment against the Baseline Requirements (BRs)

Discussion Forums

The following Mozilla public forums are relevant to CA evaluation and related issues. Each forum can be accessed either as a mailing list, over the web or as a newsgroup.

• mozilla.dev.security.policy (MDSP). This forum is used for discussions of Mozilla policies related to security in general and CAs in particular, and for wider discussions about the WebPKI. Among other things, it is the preferred forum for the public comment phase of CA evaluation. If you are a regular participant in MDSP, then please add your name to the Policy Participants page.
• mozilla.dev.tech.crypto. This forum is used for discussions of the NSS cryptographic library used in Firefox and other Mozilla-based products, as well as the PSM module that implements higher-level security protocols for Firefox.
• mozilla.dev.security. This forum is used for discussions of Mozilla security issues in general.

Override Default Trust Settings in Firefox

Users of Firefox or other Mozilla products may override the default root certificate settings by either deleting root certificates or by changing the trust bit settings of a root certificate.

How to Apply for Root Inclusion or Changes

• Process Overview
• How to Apply -- A guide for CAs wishing to include their certificate in Mozilla's Root CA store, and also a guide for CAs wishing to add trust bits or enable EV for a certificate that is already included in Mozilla's Root CA store.
• Root Change Process -- How to request a change to a root certificate that is currently included in NSS. This includes the process for disabling or removing a root certificate from NSS.

• Checklist of CA information required to process a CA's application
• Recommended practices for CAs wishing to have their root CA certificates included in Mozilla products
• Potentially problematic CA practices. This discusses CA practices that are not explicitly forbidden by the Mozilla CA policy, and do not necessarily pose security issues, but that some people have expressed concerns about and that may cause delays in evaluating and approving CA applications. Some of these practices may be addressed in future versions of the Mozilla CA policy.
• Queue for Public Discussion of CA evaluations
• Technical recommendations for root certificates. This is a very first-cut attempt to outline what root certificates should contain, based on the relevant RFCs as supplemented by existing practices.
• Checklist for Subordinate CAs and CSPs Information needed when subordinate CAs are operated by third parties.

• EV Testing in Firefox: Explains how you can test that your CA certificate (that you want to enable for EV) and your OCSP infrastructure is working correctly according to the expectations of Mozilla, Firefox, the NSS library, and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software).
  • EV certificates and revocation checking. This discusses how revocation checking via OCSP or CRLs affects the UI treatment of EV certificates.
• Terminology
  • Glossary of CA- and Mozilla-related terms. Useful for following Mozilla CA-related discussions.
  • High Level Terminology
• Certificate download specification. This document describes the data formats used by Mozilla products for installing certificates.