Confirmed users, Administrators
5,526
edits
CA/Application Instructions: Difference between revisions
Jump to navigation
Jump to search
cleanup
m (cleanup) |
(cleanup) |
||
| Line 51: | Line 51: | ||
== Common CA Database == | == Common CA Database == | ||
CAs must follow [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy | CAs must follow [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Mozilla's Root Store Policy] the entire time they have a root certificate [[CA/Included_Certificates|included in Mozilla’s root store]]. | ||
CAs are required to: | CAs are required to: | ||
* Annually provide public-facing statement(s) of attestation of their conformance to the stated verification requirements. | * Annually provide public-facing statement(s) of attestation of their conformance to the stated verification requirements. | ||
* Notify Mozilla when its policies and business practices change in regards to verification procedures for issuing certificates, when the ownership control of the CA’s certificate(s) changes, or when ownership control of the CA’s operations changes. | * Notify Mozilla when its policies and business practices change in regards to verification procedures for issuing certificates, when the [[CA:RootTransferPolicy|ownership control of the CA’s certificate(s) changes]], or when ownership control of the CA’s operations changes. | ||
* Ensure that Mozilla has their current | * Ensure that Mozilla has their current [[CA/Information_Checklist#CA_Primary_Point_of_Contact_.28POC.29|contact information]]. | ||
Additionally, CAs must maintain their data in the [ | Additionally, CAs must maintain their data in the [http://ccadb.org/ Common CA Database] about: | ||
* All certificates that are capable of being used to issue new certificates, and which directly or transitively chain to their certificate(s) included in Mozilla’s CA Certificate Program that are not technically constrained | * All certificates that are capable of being used to issue new certificates, and which directly or transitively chain to their certificate(s) included in Mozilla’s CA Certificate Program that are not technically constrained via EKU and name constraints. | ||
* | * Revoked certificates that were capable of being used to issue new certificates, and which directly or transitively chain to their certificate(s) included in Mozilla’s CA Certificate Program and were not technically constrained via EKU and name constraints. | ||