CA
Mozilla's CA Certificate Program
Mozilla’s CA Certificate Program governs inclusion of root certificates in Network Security Services (NSS), a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products.
Override Default Root Certificate Settings
Users of Mozilla products may override the default root certificate settings by either deleting the root certificate or by changing the trust bit settings of a root certificate.
- User Root Certificate Settings -- How to override the default root settings in Mozilla products.
Policy
- Mozilla's CA Certificate Policy (current version, 2.4.1)
- Baseline Requirements Compliance: Mozilla's expectations regarding compliance with the CA/Browser Forum's Baseline Requirements
- Root Transfer Policy: Mozilla's expectations when the ownership of an included root certificate changes, the organization operating the PKI changes, and/or the private keys of the root certificate are transferred to a new location
You can also read about old versions of the policy and the policy update process.
Lists of CAs and Certificates
- Included CA Certificates
- Removed CA Certificates
- Pending CA Certificates or certificate trust bit/EV status changes
- Public Intermediate (Subordinate) CA Certificates
- Revoked Intermediate (Subordinate) CA Certificates
- NSS:Release_Versions -- Mapping of Root Cert Inclusion Bugs to Mozilla Product Releases
CA Communications
- Communications sent to CAs and their responses
Common CA Database (aka CA Community in Salesforce)
Mozilla's CA Program uses the Common CA Database, also known as the CA Community in Salesforce, which is a highly customized CRM used for managing CA Program data. The Common CA Database enables CAs to directly provide the data for all of the publicly disclosed and audited subordinate CAs chaining up to root certificates in Mozilla's program, and to also directly provide data about their revoked intermediate certificates. A Primary Point of Contact for each included CA will be given a CA Communitylicense, so that each of the CAs in Mozilla's program can input, access, and update their intermediate certificate data directly in the Common CA Database.
- CA Members of the Common CA Database
- A CA Member is any CA participating in the Common CA Database via Community licenses, subject to Mozilla policies. CA Members have restricted access to certain parts of the data in the Common CA Database. They can only modify the data regarding intermediate certificates chaining up to their own root certificates. They have read-only access to root certificate data, and they do not have access to Cases regarding root inclusion/change requests.
- Root Store Members of the Common CA Database
- A Root Store Member is any root store operator participating in the Common CA Database who has signed Mozilla's Common CA Database Agreement.
- Note: "Common CA Database" is the new name for "CA Community in Salesforce".
Maintenance and Enforcement
- Maintaining Confidence in Root Certificates -- includes potential problems, prevention, and response.
- CA Mis-Issuance Bugs: https://wiki.mozilla.org/CA/ca-bugs
- Whiteboard tags used in the CA Program https://wiki.mozilla.org/CA_Bug_Triage
How to Apply for Root Inclusion or Changes
- Process Overview
- How to Apply -- A guide for CAs wishing to include their certificate in Mozilla's Root CA store, and also a guide for CAs wishing to add trust bits or enable EV for a certificate that is already included in Mozilla's Root CA store.
- Root Change Process -- How to request a change to a root certificate that is currently included in NSS. This includes the process for disabling or removing a root certificate from NSS.
- Checklist of CA information required to process a CA's application
- Recommended practices for CAs wishing to have their root CA certificates included in Mozilla products
- Potentially problematic CA practices. This discusses CA practices that are not explicitly forbidden by the Mozilla CA policy, and do not necessarily pose security issues, but that some people have expressed concerns about and that may cause delays in evaluating and approving CA applications. Some of these practices may be addressed in future versions of the Mozilla CA policy.
- Queue for Public Discussion of CA evaluations
- Technical recommendations for root certificates. This is a very first-cut attempt to outline what root certificates should contain, based on the relevant RFCs as supplemented by existing practices.
- Checklist for Subordinate CAs and CSPs Information needed when subordinate CAs are operated by third parties.
- EV Testing in Firefox: Explains how you can test that your CA certificate (that you want to enable for EV) and your OCSP infrastructure is working correctly according to the expectations of Mozilla, Firefox, the NSS library, and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software).
- EV certificates and revocation checking. This discusses how revocation checking via OCSP or CRLs affects the UI treatment of EV certificates.
- Terminology
- Glossary of CA- and Mozilla-related terms. Useful for following Mozilla CA-related discussions.
- High Level Terminology
- Certificate download specification. This document describes the data formats used by Mozilla products for installing certificates.
Discussion Forums
The following Mozilla public forums are relevant to CA evaluation and related issues. Note that each forum can be accessed either as a mailing list or a newsgroup (using an NNTP-newsreader or the Google Groups service).
- Policy forum. This forum is used for discussions of Mozilla policies related to security in general and CAs in particular; among other things, it is the preferred forum for the public comment phase of CA evaluation.
- newsgroup: mozilla.dev.security.policy
- mailing list: dev-security-policy@mozilla.org
- If you are a regular participant in the mozilla.dev.security.policy forum, then please add your name to the Policy Participants page.
- Crypto forum. This forum is used for discussions of the NSS cryptographic library used in Firefox and other Mozilla-based products, as well as the PSM module that implements higher-level security protocols for Firefox, et.al. Note that this forum was previously used to discuss CA request, but such discussions should now be moved to the policy forum.
- newsgroup: mozilla.dev.tech.crypto
- mailing list: dev-tech-crypto@mozilla.org
- Security forum. This forum is used for discussions of Mozilla security issues in general. Crypto-related discussions should be moved to mozilla.dev.tech.crypto.
- newsgroup: mozilla.dev.security
- mailing list: dev-security@mozilla.org
Work in Progress
- CA Self-Assessment of BRs
- Phasing out SHA-1 Certificates
- Plan for Improving Revocation Checking in Firefox
- SSL Burn Down List -- Collecting/prioritizing NSS and PSM work.
- OCSP Hard Fail -- What needs to be done before we can set OCSP to hard fail by default?
- Sandbox for identifying and resolving issues with the CA Inclusion Process
Templates
Obsolete
The following items are obsolete, and have been replaced by other links provided above.
- Applying for inclusion of CA root certificates. This wiki page has been replaced by A guide for CAs.
- Root Removal Policy Discussion. This wiki page is used to review and comment on the proposed policy and process for removing a CA root certificate.
Obsolete Templates
The following are templates created by Gerv Markham for use by the Mozilla representative(s) responsible for working on CA requests. Except as noted the templates are used in creating comments for the bug report associated with a CA request.