Confirmed users, Administrators
5,526
edits
CA/CertificatePolicyV2.1: Difference between revisions
no edit summary
No edit summary |
|||
| Line 37: | Line 37: | ||
* Mozilla grants an exception to the trust anchors in Mozilla's program that are signed by national policy root certificates whose corresponding national policy does not allow the subordinate CA to issue other subordinate CA certificates. | * Mozilla grants an exception to the trust anchors in Mozilla's program that are signed by national policy root certificates whose corresponding national policy does not allow the subordinate CA to issue other subordinate CA certificates. | ||
* Mozilla grants an exception to the trust anchors that are signed by a national CA who is working towards inclusion of the national root certificate, but Mozilla has requested that each subordinate CA be evaluated separately first. | * Mozilla grants an exception to the trust anchors that are signed by a national CA who is working towards inclusion of the national root certificate, but Mozilla has requested that each subordinate CA be evaluated separately first. | ||
=== Baseline Requirements === | |||
Item #12 of the [[CA:CertInclusionPolicyV2.1 | Inclusion Policy]] adds the requirement for CA operations and issuance of certificates to be used for SSL-enabled servers to also conform to version 1.1 of the [http://www.cabforum.org/documents.html CA/Browser Forum Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates.] | |||
* As of February 2013, SSL certificate issuance must also be audited according to the Baseline Requirements (BRs), [[CA:CertificatePolicyV2.1#Audit_Criteria | as described above.]] The first BR audit for each CA and subCA may include a reasonable list of BRs that the CA (or subCA) is not yet in compliance with. The second BR audit (the following year) is expected to confirm that the issues that were listed in the previous BR audit have been resolved. | |||
* All other dates are as specified by the CA/Browser Forum. | |||
=== Technical Constraints or Auditing/Disclosure of Intermediate Certificates === | === Technical Constraints or Auditing/Disclosure of Intermediate Certificates === | ||
| Line 46: | Line 53: | ||
** A pre-existing externally-operated subordinate CA certificate that expires before May 15, 2014 may be re-issued in order to extend the validity period of the currently-valid intermediate CA certificate until May 15, 2014. That is, the replacement certificate's notAfter date would be May 15, 2014 or earlier. | ** A pre-existing externally-operated subordinate CA certificate that expires before May 15, 2014 may be re-issued in order to extend the validity period of the currently-valid intermediate CA certificate until May 15, 2014. That is, the replacement certificate's notAfter date would be May 15, 2014 or earlier. | ||
* All certificates that are capable of being used to issue new certificates must comply with [[CA:CertInclusionPolicyV2.1 | version 2.1]] or later of [http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/inclusion/ Mozilla's CA Certificate Inclusion Policy] for new certificate issuance by May 15, 2014. | * All certificates that are capable of being used to issue new certificates must comply with [[CA:CertInclusionPolicyV2.1 | version 2.1]] or later of [http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/inclusion/ Mozilla's CA Certificate Inclusion Policy] for new certificate issuance by May 15, 2014. | ||
== Frequently Asked Questions == | == Frequently Asked Questions == | ||