Confirmed users
659
edits
CA/Lessons Learned: Difference between revisions
Jump to navigation
Jump to search
Added section for Other Causes of Certificate Misissuance
(Added info for Compromised Keys) |
(Added section for Other Causes of Certificate Misissuance) |
||
| Line 35: | Line 35: | ||
| [https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&short_desc=serial%20number%20entropy&short_desc_type=substring&query_format=advanced&product=CA%20Program&resolution=FIXED Numerous bugs] | | [https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&short_desc=serial%20number%20entropy&short_desc_type=substring&query_format=advanced&product=CA%20Program&resolution=FIXED Numerous bugs] | ||
| Check entropy with pre-issuance linting; specify more entropy than is required; follow cryptographic best practices; keep CA software up to date; test CA software for compliance with requirements; provide developers with training on the proper calculation of entropy | | Check entropy with pre-issuance linting; specify more entropy than is required; follow cryptographic best practices; keep CA software up to date; test CA software for compliance with requirements; provide developers with training on the proper calculation of entropy | ||
|- | |- | ||
| Improper Key Usage | | Improper Key Usage | ||
| Line 92: | Line 88: | ||
| Enforce use of approved methods; eliminate potential for human error; regularly update CP and CPS with allowed methods; use proper Random Values; do not use look-ups to external resources that are subject to attack | | Enforce use of approved methods; eliminate potential for human error; regularly update CP and CPS with allowed methods; use proper Random Values; do not use look-ups to external resources that are subject to attack | ||
|- | |- | ||
| CAA-based Misissuances | | CAA Checking Failures and CAA-based Misissuances | ||
| Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc=CAA&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring CAA] | | Summary search string: [https://bugzilla.mozilla.org/buglist.cgi?short_desc=CAA&query_format=advanced&product=CA%20Program&resolution=FIXED&component=CA%20Certificate%20Compliance&short_desc_type=substring CAA] | ||
| | | Check all domains to be contained in the certificate, automate and do not bypass CAA record checks; review and clearly understand CAA flags; keep CAA verification logic up to date; document and automate CAA validator configurations; communicate CAA checking requirements clearly to developers; train staff who configure and perform CAA checking; run CAA checks immediately before certificate issuance (to avoid TTL issues with CAA records) | ||
|- | |||
! colspan="3" style="text-align:left;" | Other Causes of Certificate Misissuance | |||
|- | |||
| Failed Pre-Certificate/SCT Processes | |||
| | |||
| | |||
|- | |||
| Reuse of Stale Validation Data | |||
| | |||
| | |||
|- | |||
| | |||
| | |||
| | |||
|- | |||
| Issuance to Compromised Keys | |||
| Bug #s [https://bugzilla.mozilla.org/show_bug.cgi?id=1927532 1927532], [https://bugzilla.mozilla.org/show_bug.cgi?id=1931683 1931683], [https://bugzilla.mozilla.org/show_bug.cgi?id=1927384 1927384], [https://bugzilla.mozilla.org/show_bug.cgi?id=1931515 1931515] | |||
| When keyCompromise is the revocation reason, then block the key from reuse, disallow reissuance using the same CSR after revocation, maintain a hash-indexed registry of compromised public keys, screen certificate requests for disallowed key re-use, implement tooling to automatically check public keys at issuance time against lists of compromised keys, identify existing certificates with compromised keys | |||
|- | |- | ||
! colspan="3" style="text-align:left;" | Failure to Revoke and Revocation Delays | ! colspan="3" style="text-align:left;" | Failure to Revoke and Revocation Delays | ||