Confirmed users
659
edits
CA/Lessons Learned: Difference between revisions
Jump to navigation
Jump to search
→Revocation-related Issues: Added links to OCSP-related bugs
(Split table into sections and added some OCSP-related text) |
(→Revocation-related Issues: Added links to OCSP-related bugs) |
||
| Line 148: | Line 148: | ||
|- | |- | ||
| Unavailable CRLs and OCSP Service Outages, including expired domains, misconfigured alerting and syncing/uploading, and problems with error handling | | Unavailable CRLs and OCSP Service Outages, including expired domains, misconfigured alerting and syncing/uploading, and problems with error handling | ||
| [https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&status_whiteboard=crl%20ocsp&product=CA%20Program&short_desc_type=allwordssubstr&query_format=advanced&status_whiteboard_type=anywordssubstr&resolution=---&resolution=FIXED&short_desc=avail Whiteboard: crl OR ocsp Summary search string: avail] | | [https://bugzilla.mozilla.org/buglist.cgi?component=CA%20Certificate%20Compliance&status_whiteboard=crl%20ocsp&product=CA%20Program&short_desc_type=allwordssubstr&query_format=advanced&status_whiteboard_type=anywordssubstr&resolution=---&resolution=FIXED&short_desc=avail Whiteboard: crl OR ocsp Summary search string: avail] | ||
OCSP Bug #s [https://bugzilla.mozilla.org/show_bug.cgi?id=1954580 1954580], [https://bugzilla.mozilla.org/show_bug.cgi?id=1957140 1957140], [https://bugzilla.mozilla.org/show_bug.cgi?id=1964866 1964866], [https://bugzilla.mozilla.org/show_bug.cgi?id=1908128 1908128], [https://bugzilla.mozilla.org/show_bug.cgi?id=1917459 1917459], [https://bugzilla.mozilla.org/show_bug.cgi?id=1931636 1931636], [https://bugzilla.mozilla.org/show_bug.cgi?id=1933353 1933353], [https://bugzilla.mozilla.org/show_bug.cgi?id=1946927 1946927] | |||
| Deploy robust and high-availability solutions on redundant systems; publish to CDNs; increase frequency of publication and distribution; implement continuous monitoring and alerts, including for domain registration renewal--but do not rely on alerting alone; make sure that configurations and changes are carefully performed; check for any performance issues or failures following any changes, including after the application of server OS updates; clearly document procedures and processes; monitor on https://sslmate.com/labs/crl_watch/ and https://sslmate.com/labs/ocsp_watch/; make sure CRLs have the correct distinguished names and match byte-wise what is in certificates | | Deploy robust and high-availability solutions on redundant systems; publish to CDNs; increase frequency of publication and distribution; implement continuous monitoring and alerts, including for domain registration renewal--but do not rely on alerting alone; make sure that configurations and changes are carefully performed; check for any performance issues or failures following any changes, including after the application of server OS updates; clearly document procedures and processes; monitor on https://sslmate.com/labs/crl_watch/ and https://sslmate.com/labs/ocsp_watch/; make sure CRLs have the correct distinguished names and match byte-wise what is in certificates | ||
|- | |- | ||
| Line 171: | Line 173: | ||
| Automate; configure/force DER formatting as default; carefully apply vendor patches/updates; implement tests and monitoring | | Automate; configure/force DER formatting as default; carefully apply vendor patches/updates; implement tests and monitoring | ||
|} | |} | ||
== Disclosure/Reporting Failures == | == Disclosure/Reporting Failures == | ||
{| class="wikitable" | {| class="wikitable" | ||