CA/Bug Triage

From MozillaWiki
< CA
Jump to: navigation, search

CA Program Bugzilla Dashboards

Bug Triage in Mozilla's CA Certificate Program

Mozilla’s CA Certificate Program governs inclusion of root certificates in Network Security Services (NSS), a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products.

The Bugzilla products/components related to the CA Certificate Program are:

The CA Certificate Program deviates from Mozilla's standardized Bugzilla Bug Triage process by not using bug priorities (P1, P2, P3, or P5), because CA Certificate Root Program bugs do not directly include code changes to Mozilla's release trains or iterations.

Compliance Problems and Incidents

To report a concern about certificates being issued by a CA in Mozilla's Program, or their audit statements:

If the bug is in regards to CA certificate issuance, then the bug summary should begin with the CA name, so sorting the bugs by Summary will sort the bugs by CA.

Open CA Compliance bugs: https://wiki.mozilla.org/CA/Incident_Dashboard

If the concern is in regards to audit statements not containing expected information, then the bug summary should begin with auditor's name, so sorting the bugs by Summary will sort the bugs by auditor name.

Open Auditor Compliance bugs: https://wiki.mozilla.org/CA/Auditor_Compliance

The whiteboard tags for NSS :: CA Certificate Compliance are:

Root Inclusion/Change requests and EV Treatment Enablement Requests

A representative of a CA may begin the process of root inclusion, change, or ev-enablement by filing a Bugzilla Bug as described here:

Root Inclusion Requests are prioritized as described here:

The whiteboard tags for NSS :: CA Certificate Root Program are:

CA Audit Statement Bugs

  • [ca-audits] -- One bug may be created per CA to store audit statements or CP/CPS documents.
    • Link to create ca-audit bug
    • Make sure the bug has the correct product/component for the CA Certificate Program, which is NSS :: CA Certificate Root Program
    • Add [ca-audits] to the Whiteboard
    • Add Comment: "This bug may continue to be used for uploading audit statements and documents for this CA."
    • Close bug as RESOLVED | WORKSFORME

CA Program Process or Policy Related Bugs

Certificate Revocation Related Bugs

  • [ca-onecrl] -- bugs related to updating entries in OneCRL. Under normal circumstances a Bugzilla Bug is not needed for this. Rather, the CA should report the revocation via the Common CA Database.
  • OneCRL Entries Generated -- bugs for verifying OneCRL entries before they are pushed to production. These bugs are automatically generated from CCADB for standard revocations of intermediate certificates that are reported by CAs. Otherwise these bugs are generated by manually running the tools for specially requested additions to OneCRL.

Common CA Database (CCADB)

  • [ccadb-bug] -- for issues or problems using the CCADB.
  • [ccadb-enhancement] -- for requesting minor updates to the CCADB, such as adding sections or fields to pages for root store members.
  • [ccadb-roadmap] -- for tracking large updates to the CCADB, which are prioritized by the CCADB Council in the CCADB Roadmap.

The Priority field is used for Common CA Database bugs as follows:

  • P1 - In Progress and being actively worked on
  • P2 - Needs to be started soon
  • P3 - Ongoing project that is being done as time permits
  • P4 - To be scheduled for work later