Confirmed users, Administrators
5,526
edits
CA/Root Inclusion Considerations: Difference between revisions
Jump to navigation
Jump to search
CA/Root Inclusion Considerations (view source)
Revision as of 00:41, 17 February 2023
, 17 February 2023make "concerning in aggregate" and auditor more clear
m (incorporating feedback) |
(make "concerning in aggregate" and auditor more clear) |
||
| Line 30: | Line 30: | ||
== Concerning Behavior == | == Concerning Behavior == | ||
The following situations are concerning | The following situations are concerning '''in aggregate'''; meaning that a concern would be raised when a collection (several) of the main bullet points below happen. These '''concerns in aggregate''' may lead to Mozilla denying the CA operator's root inclusion request. If the CA operator currently has root certificates in Mozilla's root store and these concerns in aggregate apply, then Mozilla should perform a risk versus value assessment, and may remove those root certificates or set them to be distrusted after a specified date. | ||
* The CA’s provided address is a P.O. box, mail drop, or an address shared with numerous other companies/entities. (e.g. shell corporate registry) | * The CA’s provided address is a P.O. box, mail drop, or an address shared with numerous other companies/entities. (e.g. shell corporate registry) | ||
* The CA's auditor has not audited other CAs whose root certificates are already included in Mozilla’s Root store. | * The CA's auditor (i.e. the [[CA/Audit_Statements#Auditor_Qualifications|third-party auditing organization]]) has not audited other CAs whose root certificates are already included in Mozilla’s Root store. | ||
* The CA's representatives are not fully transparent on matters such as legal domicile and Control. | * The CA's representatives are not fully transparent on matters such as legal domicile and Control. | ||
** "Control" (and its correlative meanings, "controlled by" and "under common control with") means possession, directly or indirectly, of the power to: (1) direct the management, personnel, finances, or plans of such entity; (2) control the election of a majority of the directors ; or (3) vote that portion of voting shares required for "control" under the law of the entity's Jurisdiction of Incorporation or Registration but in no case less than 10%. | ** "Control" (and its correlative meanings, "controlled by" and "under common control with") means possession, directly or indirectly, of the power to: (1) direct the management, personnel, finances, or plans of such entity; (2) control the election of a majority of the directors ; or (3) vote that portion of voting shares required for "control" under the law of the entity's Jurisdiction of Incorporation or Registration but in no case less than 10%. | ||