NSS:CAInclusionProcessIssues

From MozillaWiki
Revision as of 23:03, 19 January 2012 by Kathleen Wilson (talk | contribs) (Created page with "This page was created so people can add and track progress of resolving issues/concerns with Mozilla's current CA Inclusion Process. == Issues currently being worked on == As [...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

This page was created so people can add and track progress of resolving issues/concerns with Mozilla's current CA Inclusion Process.

Issues currently being worked on

As Mozilla's CA Certificate Policy is updated, CAs with root certs included in NSS are given a time frame to come into compliance with the new rules. The new rules are also applied to CAs with requests in the queue for discussion.

Here are issues with Mozilla's CA Inclusion Process that are currently being worked on, and the actions that are being taken.

Accountability of sub-CAs

The current WebTrust and ETSI audits don't sufficiently check network security protections.

  • CA Communication sent to CAs in September. All CAs must appropriately respond to that communication and provide further information in those areas before their inclusion request may enter public discussion.
  • Updating Mozilla's CA Certificate Policy to add a requirement for CAs to comply with the CA/Browser Forum’s Baseline Requirements, and be audited to those criteria. In particular, BR 16 addresses data security, risk assessment, security, plan, system security, and private key protection. This is currently in discussion in m.d.s.policy. CAB Forum is working to have audits include the BRs by the end of 2012.

Issues that need to be addressed

The following are issues with Mozilla's CA Inclusion Process that people would like to have addressed.