Confirmed users
682
edits
CA/External Sub CAs: Difference between revisions
Jump to navigation
Jump to search
m
minor edit
(More hyperlink edits) |
m (minor edit) |
||
| Line 1: | Line 1: | ||
= Externally Operated Subordinate CAs = | = Externally Operated Subordinate CAs = | ||
| Line 82: | Line 81: | ||
6. Audit statements, [CA/Audit_Statements#Providing_Auditor_Qualifications auditor information and qualifications] | 6. Audit statements, [CA/Audit_Statements#Providing_Auditor_Qualifications auditor information and qualifications] | ||
a. May be uploaded as an attachment to the [[CA/External_Sub_CAs#Bugzilla_Bug|Bugzilla Bug]] | a. May be uploaded as an attachment to the [[CA/External_Sub_CAs#Bugzilla_Bug|Bugzilla Bug]] | ||
b. Subordinate CA audits must follow the same audit rules as for root CAs, as per [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#3-documentation MRSP section 3] | b. Subordinate CA audits must follow the same audit rules as for root CAs, as per [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#3-documentation MRSP section 3] | ||
c. If the subordinate CA is new, a point-in-time audit statement may be initially used | c. If the subordinate CA is new, a point-in-time audit statement may be initially used | ||
d. If key generation has already occurred, then the root CA operator should provide a copy of the relevant auditor-supplied documentation (e.g. a key generation report). | d. If key generation has already occurred, then the root CA operator should provide a copy of the relevant auditor-supplied documentation (e.g. a key generation report). | ||
7. The subordinate CA’s [CA/Compliance_Self-Assessment Compliance Self-Assessment] | 7. The subordinate CA’s [CA/Compliance_Self-Assessment Compliance Self-Assessment] | ||
| Line 96: | Line 95: | ||
9. Explanation about why this subordinate CA is needed, e.g. [CA/Quantifying_Value Value Justification]. For example, the primary reason in the explanation can be that: | 9. Explanation about why this subordinate CA is needed, e.g. [CA/Quantifying_Value Value Justification]. For example, the primary reason in the explanation can be that: | ||
a. a large enterprise wants to manage the certificates for domains that they own, or. | a. a large enterprise wants to manage the certificates for domains that they own, or. | ||
b. the CA certificate is for a new root CA operator who wishes to be cross-signed in order to provide ubiquity across browsers after their root certificate has been approved for inclusion in Mozilla’s root store. | b. the CA certificate is for a new root CA operator who wishes to be cross-signed in order to provide ubiquity across browsers after their root certificate has been approved for inclusion in Mozilla’s root store. | ||
== Public Discussion == | == Public Discussion == | ||
| Line 114: | Line 113: | ||
If the subordinate CA is rejected, then any corresponding existing certificates issued by the root CA to the subordinate CA operator will be added to [https://crt.sh/mozilla-onecrl OneCRL]. | If the subordinate CA is rejected, then any corresponding existing certificates issued by the root CA to the subordinate CA operator will be added to [https://crt.sh/mozilla-onecrl OneCRL]. | ||
= Technically-Constrained Subordinate CAs = | = Technically-Constrained Subordinate CAs = | ||
TBD | TBD | ||