CA/Lessons Learned

	THIS PAGE IS A WORKING DRAFT
	The page may be difficult to navigate, and some information on its subject might be incomplete and/or evolving rapidly. If you have any questions or ideas, please add them as a new topic on the discussion page.

Incorrect Certificate Profiles and Misconfigured Certificates
Compliance Issue or Root Cause	Mitigation Strategies
General Issues of Non-Compliance (e.g. certificates that do not comply with CA/B Forum requirements or Mozilla Policy)	Closely monitor changes in requirements; conduct regular audits and reviews; provide training; implement automated compliance tools
Certificate Profile Errors (see below - certificates issued with profiles not adhering to requirements, certificates with incorrect Subject attribute order, incorrect key usages, etc.)	Use standardized templates that have been validated against CABF and Mozilla requirements; automate the profile validation process
Duplicate Serial Numbers Bug #s 1636140, 1677737	Unique serial number generation; database checks; eliminate the potential that certificate orders remain in the issuance queue when re-starting or re-configuring CA systems; generate the final certificate immediately upon receipt of the SCTs;
Insufficient Serial Number Entropy Numerous bugs	Check entropy with pre-issuance linting; specify more entropy than is required; follow cryptographic best practices; keep CA software up to date; test CA software for compliance with requirements; provide developers with training on the proper calculation of entropy;
Improper Key Usage Bug #s 1756122, 1647468, 1667448, 1703528	Pre-issuance linting; check keyUsage configuration in certificate profiles using automated tools; review section 7 of the Baseline Requirements; implement dual control for certificate template changes;
Invalid CN/SAN Entries Bug #s 1687139, 1705187, 1716123, 1462423, 1897346	Pre-issuance linting; implement automated checks for CN and SAN matching; conduct code review and system testing;
Invalid Certificate Extensions/Non-Standard Extensions Bug #s 1899466, 1876565, 1498463, 1524451	Implement strict validation processes to detect and reject non-standard extensions; stay updated on revisions to requirements; implement pre-issuance linting;
Invalid OrganizationIdentifier Bug #s 1897538, 1898986, 1769240, 1900492	Write detailed specifications; conduct code review; improve training and internal communications; improve linting; update validation scheme logic; replace manual processes with automation;
Overly Long Certificate Lifetimes/Validity Periods Bug #s 1826713, 1774418, 1676352	Keep certificate profile management system updated; review certificate profiles on system startup; implement pre-issuance linting; set maximum validity periods to much less than that allowed by the requirements; don’t give credits for early certificate renewals;
Use of Deprecated or Incorrect Algorithms Bug #s 1648472, 1793441, 1664328,	Stay up-to-date with approved algorithms listed in requirements; conduct detailed certificate profile checks, and use automation where feasible; update system logic so that it selects the correct algorithm; implement pre-issuance linting;
Wildcard Mis-issuance Bug #s 1446121, 1528263, 1782391, 1731939,	Block wildcards in EV certificates; ensure proper syntax and ASN.1 encoding per RFC 5280; implement pre-issuance linting;
Incorrect Certificate Subject Details
Invalid Organization Information Bug #s 1680083, 1674886, 1838371, 1535735, 1662382, 1705647, 1746421, 1813989, 1815527, 1828105, 1826235	Implement stringent validation and pre-issuance linting; ensure that any abbreviations used are correct; cross-check with multiple authoritative databases; sanitize internal lookup databases; ensure correct domain name registrant's organization name is placed in the certificate; prevent placement of organization information in DV certificates; test system changes; automate lookups and reduce human error; do not rely on CSRs for organization information;
Incorrect Address Fields streetAddress, locality names, stateOrProvinceName, postalCode, country	Automate address validation and reduce human involvement that leads to typos, etc.; cross-check with multiple authoritative databases; prevent placement of organization information in DV certificates; sanitize internal lookup databases; do not rely on CSRs for organization information; implement tools that verify locality, state, and country combinations; do not allow the pass-through of default/filler data into the certificate; use the correct abbreviations for geographic locations;
Insufficient Domain Validation
Improper Use of Domain Validation Methods (Issuance of Certificates for Unregistered Domains)	Enforce use of approved methods; eliminate potential for human error; regularly update CP and CPS with allowed methods; use proper Random Values; do not use look-ups to external resources that are subject to attack;
CAA-based Misissuances Keyword: CAA	Automate and do not bypass CAA record checks; keep CAA verification logic up to date; communicate CAA checking requirements clearly to developers; run CAA checks immediately before certificate issuance (to avoid TTL issues with CAA records); check all domains to be contained in the certificate
Failure to Revoke and Revocation Delays
Delayed Revocations Whiteboard search: leaf	Automated revocation systems; improved incident response procedures; reduced mis-issuance (see rows above), including pre-issuance linting, thorough review of certificate profiles, improved validation, etc.
Disclosure/Reporting Failures
Delayed, Incomplete, or Failed Disclosure of Intermediate CA Certificates in the CCADB Whiteboard: disclosureSummary search string: intermediate	Ensure coverage; provide training on CCADB tasks, especially on staff turnover; use automated tools for timely disclosure; include CCADB disclosure in key ceremony procedures; cross-reference internal databases with information in the CCADB; conduct regular audits; monitor the activity of external intermediate/subordinate CAs;
Failure to Respond to CA Survey Summary search string: Survey	Make sure emails are received; keep CCADB updated with communication group email addresses; provide training; document procedures; prioritize responses to root programs; set deadlines in calendaring systems
CRL and OCSP Failures
Unavailable CRLs and OCSP Service Outages Whiteboard: crl OR ocspSummary search string: avail	Deploy high-availability solutions on redundant systems; publish to CDNs; continuous monitoring and alerts; monitor on https://sslmate.com/labs/crl_watch/ and https://sslmate.com/labs/ocsp_watch/; make sure CRLs have the correct names and match what is in certificates;
Incorrect OCSP Responses Whiteboard: ocspSummary search string: response	Update CA software; perform QA testing; monitor performance of internal systems; regularly check https://sslmate.com/labs/ocsp_watch/; ensure that OCSP responses are provided for pre-certificates;
Expired or Invalid CRLs Whiteboard: crlSummary search string:expired	Implement automated CRL management; validate CRL profiles against CABF and root program requirements;
Mismatch Between CA SubjectDN and CRL Issuer SubjectDN Bug #s 1888371,	Implement consistency checks and ensure that CRL issuer matches CA subject byte-for-byte; monitor on https://sslmate.com/labs/crl_watch/;
Policy and Practice Failures
Failure to Publish Annual CP or CPS Updates Bug #s 1565494, 1769222 Summary search string: annual cps update	Schedule regular updates; involve stakeholders in review process; ensure adequate staffing;
Mistakes and erroneous information in CP or CPS Whiteboard: policySummary search string:cps	Update CP/CPS to address CABF and root program changes to requirements (e.g. domain validation methods); implement validation processes for CP/CPS updates; conduct regular CP/CPS reviews that also checks operational behaviors (e.g. CRL issuance frequency); double-check certificate profiles published in CP/CPS; conduct peer reviews before CP/CPS publication; include CP/CPS review in operational change processes (whenever a proposed code change will introduce or change a feature);
Delayed Responses to Certificate Problem Reports (CPRs) Whiteboard label:policy-failureSummary search string:cpr	Establish clear response time policies; use email distribution lists; designate a sufficient number of responsible individuals to answer CPRs; use automated ticketing systems; update CCADB records as soon as changes occur;
Audit Issues, Delays, and Failures
Delayed Audit Statements Whiteboard label: audit-delay	Implement strict audit scheduling; use calendaring, monitoring and alerting; enter into engagement letters with auditors well ahead of the planned audit dates; develop contingency plans to address potential delays, disruptions, or auditor unavailability; gather documentation in advance of audit; follow up with auditor on expected delivery of audit letter;
Audit Letter Validation Failures Summary search string: ALV	Follow all guidance on the CCADB website, including https://www.ccadb.org/cas/alv;
Missing CAs in Audit Letters Whiteboard label:audit-failureSummary search string:intermediate	Include all intermediate and cross-certified CAs “capable of issuing” the particular kind of end entity certificate covered by the audit (TLS Capable, S/MIME Capable, etc.); use the 7MB All CA Certificates CSV list to identify all CA certificates that are “capable” of such issuance; communicate audit letter requirements to your auditor;
Auditor Qualifications Whiteboard label: auditor-compliance	Ensure auditors are qualified and certified; review the Mozilla wikipage on Auditor Qualifications;
Test Certificates
Test Website Certificates Summary search string: test website	Implement certificate management tools; and calendaring for replacing the certificates used on test websites; regularly check for certificate expiration for “valid” and “revoked” certificates; provide training;
Issuance of Test Certificates Summary search string: test certificate	Use PKI hierarchies that are not publicly trusted or complete all validation and other pre-issuance steps for the test certificate;
Internal Security Issues
Logging Issues Summary search string: log	Implement robust log management systems; log to a separate log server; leverage “big data” solutions; freeze operations if logging is not working; monitor logs in real-time with solutions that provide alerting and data analysis; regularly audit system logs;
Improper Access Control Summary search string: access	Establish and follow strict access control policies; conduct regular reviews of access control lists;