CA/Root Store Policy Archive: Difference between revisions

CA/Root Store Policy Archive (view source)

294 bytes added , 10 December 2015

Confirmed users, Administrators

5,526

edits

@@ Line 145: / Line 145: @@
 # ''In item #8 of the [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/maintenance/ Maintenance Policy] add DSA 2048. -- [https://groups.google.com/d/msg/mozilla.dev.security.policy/JFmDFlHILOY/KHJzcJezpnQJ Discussion result:]No, we should not add DSA support to Mozilla's CA Certificate Policy, and mozilla::pkix does not need to support DSA certificates.''
-=== Consider for Version 3.0 ===
+=== Consider for Version 2.4 ===
-Align Mozilla CA Certificate Policy to RFC 3647, so CAs can compare their CP/CPS side-by-side with Mozilla' policy, as well as the BRs and audit criteria (such as the forthcoming ETSI 319 411 series).
+Things that should be discussed when updating Mozilla's Policy to version 2.4:
+* Currently we are not tracking the actual audit periods, so no one is currently enforcing the rule in the BRs: "The period during which the CA issues Certificates SHALL be divided into an unbroken sequence of audit periods. An audit period MUST NOT exceed one year in duration." We could track this data in Salesforce, but we need to have policy around what the consequence should be whenever the rule is violated.
 === Items to Add/Update in the Policy ===