CA/Lessons Learned: Difference between revisions

! colspan="2" style="text-align:left;" | Incorrect Certificate Profiles and Misconfigured Certificates

! style="width: 70%;" | Corrective Measures

(see below - certificates issued with profiles not adhering to requirements, certificates with incorrect Subject attribute order, incorrect key usages, etc.)  

| Duplicate Serial Numbers  

Bug #s 1636140, 1677737

| Unique serial number generation; database checks; eliminate the potential that certificate orders remain in the issuance queue when re-starting or re-configuring CA systems; generate the final certificate immediately upon receipt of the SCTs;

| Insufficient Serial Number Entropy

[https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&short_desc=serial%20number%20entropy&short_desc_type=substring&query_format=advanced&product=CA%20Program&resolution=FIXED Numerous bugs]

| Check entropy with pre-issuance linting; specify more entropy than is required; follow cryptographic best practices; keep CA software up to date; test CA software for compliance with requirements; provide developers with training on the proper calculation of entropy;

| Improper Key Usage

Bug #s 1756122, 1647468, 1667448, 1703528

| Pre-issuance linting; check keyUsage configuration in certificate profiles using automated tools; review section 7 of the Baseline Requirements; implement dual control for certificate template changes;

| Invalid CN/SAN Entries

Bug #s 1687139, 1705187, 1716123, 1462423, 1897346

| Pre-issuance linting; implement automated checks for CN and SAN matching; conduct code review and system testing;

| Invalid Certificate Extensions/Non-Standard Extensions

Bug #s 1899466, 1876565, 1498463, 1524451

| Implement strict validation processes to detect and reject non-standard extensions; stay updated on revisions to requirements; implement pre-issuance linting;

| Invalid OrganizationIdentifier

Bug #s 1897538, 1898986, 1769240, 1900492

| Write detailed specifications; conduct code review; improve training and internal communications; improve linting; update validation scheme logic; replace manual processes with automation;

| Overly Long Certificate Lifetimes/Validity Periods

Bug #s 1826713, 1774418, 1676352

| Keep certificate profile management system updated; review certificate profiles on system startup; implement pre-issuance linting; set maximum validity periods to much less than that allowed by the requirements; don’t give credits for early certificate renewals;

| Use of Deprecated or Incorrect Algorithms

Bug #s 1648472, 1793441, 1664328,

| Stay up-to-date with approved algorithms listed in requirements; conduct detailed certificate profile checks, and use automation where feasible; update system logic so that it selects the correct algorithm; implement pre-issuance linting;

| Wildcard Mis-issuance

Bug #s 1446121, 1528263, 1782391, 1731939,

| Block wildcards in EV certificates; ensure proper syntax and ASN.1 encoding per RFC 5280; implement pre-issuance linting;

! colspan="2" style="text-align:left;" | Incorrect Certificate Subject Details

Bug #s 1680083, 1674886, 1838371, 1535735, 1662382, 1705647, 1746421, 1813989, 1815527, 1828105, 1826235

| Implement stringent validation and pre-issuance linting; ensure that any abbreviations used are correct; cross-check with multiple authoritative databases; sanitize internal lookup databases; ensure correct domain name registrant's organization name is placed in the certificate; prevent placement of organization information in DV certificates; test system changes; automate lookups and reduce human error; do not rely on CSRs for organization information;

[https://bugzilla.mozilla.org/buglist.cgi?short_desc=%20streetaddress&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring streetAddress],

[https://bugzilla.mozilla.org/buglist.cgi?short_desc=locality&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring locality names],  

 

| Automate address validation and reduce human involvement that leads to typos, etc.; cross-check with multiple authoritative databases; prevent placement of organization information in DV certificates; sanitize internal lookup databases; do not rely on CSRs for organization information; implement tools that verify locality, state, and country combinations; do not allow the pass-through of default/filler data into the certificate; use the correct abbreviations for geographic locations;

! colspan="2" style="text-align:left;" | Insufficient Domain Validation

| Enforce use of approved methods; eliminate potential for human error; regularly update CP and CPS with allowed methods; use proper Random Values; do not use look-ups to external resources that are subject to attack;

Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc=CAA&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring CAA]

! colspan="2" style="text-align:left;" | Failure to Revoke and Revocation Delays

Whiteboard search: [https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&component=CA%20Certificate%20Compliance&resolution=---&resolution=FIXED&product=CA%20Program&status_whiteboard=leaf&status_whiteboard_type=allwordssubstr leaf]  

| Reduced mis-issuance (see rows above), including pre-issuance linting, thorough review of certificate profiles, and improved validation; detailed changes to policies and procedures to ensure timely revocation, including improved incident response procedures, new guidelines, checklists, approval processes, and clearer subscriber communications; and automation and technological improvements to the infrastructure, including monitoring, auditing, and alerting, for faster detection and response to incidents requiring revocation and to quickly identify lapses in compliance with such policies and procedures;

! colspan="2" style="text-align:left;" | Disclosure/Reporting Failures

[https://bugzilla.mozilla.org/buglist.cgi?status_whiteboard=disclosure&component=CA%20Certificate%20Compliance&status_whiteboard_type=allwordssubstr&query_format=advanced&short_desc=intermediate&product=CA%20Program&short_desc_type=allwordssubstr&resolution=FIXED Whiteboard: disclosureSummary search string: intermediate]

| Ensure coverage; provide training on CCADB tasks, especially on staff turnover; use automated tools for timely disclosure; include CCADB disclosure in key ceremony procedures; cross-reference internal databases with information in the CCADB; conduct regular audits; monitor the activity of external intermediate/subordinate CAs;

Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc=survey&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring Survey]

! colspan="2" style="text-align:left;" | CRL and OCSP Failures

[https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&status_whiteboard=crl%20ocsp&product=CA%20Program&short_desc_type=allwordssubstr&query_format=advanced&status_whiteboard_type=anywordssubstr&resolution=---&resolution=FIXED&short_desc=avail Whiteboard: crl OR ocspSummary search string: avail]

| Deploy high-availability solutions on redundant systems; publish to CDNs; continuous monitoring and alerts; monitor on https://sslmate.com/labs/crl_watch/ and https://sslmate.com/labs/ocsp_watch/; make sure CRLs have the correct names and match what is in certificates;

[https://bugzilla.mozilla.org/buglist.cgi?status_whiteboard_type=allwordssubstr&short_desc=response&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=allwordssubstr&status_whiteboard=ocsp&query_format=advanced Whiteboard: ocspSummary search string: response]

| Update CA software; perform QA testing; monitor performance of internal systems; regularly check https://sslmate.com/labs/ocsp_watch/; ensure that OCSP responses are provided for pre-certificates;

[https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&status_whiteboard=crl&product=CA%20Program&status_whiteboard_type=allwordssubstr&resolution=FIXED&short_desc=expired%20invalid&short_desc_type=anywordssubstr&query_format=advanced Whiteboard: crlSummary search string:expired]

| Implement automated CRL management; validate CRL profiles against CABF and root program requirements;

Bug #s [https://bugzilla.mozilla.org/show_bug.cgi?id=1888371 1888371],

| Implement consistency checks and ensure that CRL issuer matches CA subject byte-for-byte; monitor on https://sslmate.com/labs/crl_watch/;

! colspan="2" style="text-align:left;" | Policy and Practice Failures

Bug #s 1565494, 1769222

| Schedule regular updates; involve stakeholders in review process; ensure adequate staffing;

[https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&resolution=---&resolution=FIXED&query_format=advanced&status_whiteboard_type=allwordssubstr&short_desc_type=allwordssubstr&short_desc=cps%20&status_whiteboard=policy&product=CA%20Program Whiteboard: policySummary search string:cps]

| Update CP/CPS to address CABF and root program changes to requirements (e.g. domain validation methods); implement validation processes for CP/CPS updates; conduct regular CP/CPS reviews that also checks operational behaviors (e.g. CRL issuance frequency); double-check certificate profiles published in CP/CPS; conduct peer reviews before CP/CPS publication; include CP/CPS review in operational change processes (whenever a proposed code change will introduce or change a feature);

[https://bugzilla.mozilla.org/buglist.cgi?resolution=---&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=allwordssubstr&short_desc=cpr&product=CA%20Program&query_format=advanced&status_whiteboard=policy&status_whiteboard_type=allwordssubstr Whiteboard label:policy-failureSummary search string:cpr]

| Establish clear response time policies; use email distribution lists; designate a sufficient number of responsible individuals to answer CPRs; use automated ticketing systems; update CCADB records as soon as changes occur;

! colspan="2" style="text-align:left;" | Audit Issues, Delays, and Failures

Whiteboard label:  

[https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&query_format=advanced&resolution=---&resolution=FIXED&product=CA%20Program&status_whiteboard=audit-delay&status_whiteboard_type=allwordssubstr audit-delay]

| Implement strict audit scheduling; use calendaring, monitoring and alerting; enter into engagement letters with auditors well ahead of the planned audit dates; develop contingency plans to address potential delays, disruptions, or auditor unavailability; gather documentation in advance of audit; follow up with auditor on expected delivery of audit letter;

Summary search string:  

[https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Program&resolution=---&resolution=FIXED&short_desc=ALV&query_format=advanced&short_desc_type=allwordssubstr&component=CA%20Certificate%20Compliance ALV]

| Follow all guidance on the CCADB website, including https://www.ccadb.org/cas/alv;

[https://bugzilla.mozilla.org/buglist.cgi?status_whiteboard=audit-failure&product=CA%20Program&short_desc=intermediate&short_desc_type=allwordssubstr&status_whiteboard_type=allwordssubstr&query_format=advanced&resolution=---&resolution=FIXED&component=CA%20Certificate%20Compliance Whiteboard label:audit-failureSummary search string:intermediate]

| Include all intermediate and cross-certified CAs “capable of issuing” the particular kind of end entity certificate covered by the audit (TLS Capable, S/MIME Capable, etc.); use the 7MB [https://ccadb.my.salesforce-sites.com/ccadb/AllCertificateRecordsCSVFormatv2 All CA Certificates CSV list] to identify all CA certificates that are “capable” of such issuance; communicate audit letter requirements to your auditor;

Whiteboard label: [https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&query_format=advanced&resolution=---&resolution=FIXED&product=CA%20Program&status_whiteboard=auditor&status_whiteboard_type=allwordssubstr auditor-compliance]

| Ensure auditors are qualified and certified; review the Mozilla wikipage on [[CA/Audit_Statements#Auditor_Qualifications|Auditor Qualifications]];

! colspan="2" style="text-align:left;" | Test Certificates

Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc_type=allwordssubstr&short_desc=test%20website&product=CA%20Program&component=CA%20Certificate%20Compliance&resolution=---&resolution=FIXED&query_format=advanced test website]

| Implement certificate management tools; and calendaring for replacing the certificates used on test websites; regularly check for certificate expiration for “valid” and “revoked” certificates; provide training;

Summary search string:  

[https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Program&resolution=---&resolution=FIXED&short_desc=test%20certificate&query_format=advanced&short_desc_type=allwordssubstr&component=CA%20Certificate%20Compliance test certificate]

| Use PKI hierarchies that are not publicly trusted or complete all validation and other pre-issuance steps for the test certificate;

! colspan="2" style="text-align:left;" | Internal Security Issues

Summary search string:

[https://bugzilla.mozilla.org/buglist.cgi?short_desc=log&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring log]

| Implement robust log management systems; log to a separate log server; leverage “big data” solutions; freeze operations if logging is not working; monitor logs in real-time with solutions that provide alerting and data analysis; regularly audit system logs;

Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc=access&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring access]

| Establish and follow strict access control policies; conduct regular reviews of access control lists;