CA/Application Instructions: Difference between revisions

# [https://bugzilla.mozilla.org/enter_bug.cgi?&component=CA%20Certificate%20Root%20Program&product=CA%20Program&short_desc=Add%20%5Byour%20CA%27s%20name%5D%20root%20certificate%28s%29 Create a new bug report] corresponding to your request.  

#* Product: CA Program

#* Type: task

#* Do NOT select the checkboxes to restrict visibility, such as making it confidential or marking it as a security bug. All information that is submitted for root inclusion and update requests must be publicly available.

# Provide all [[CA/Information_Checklist|required information.]]  

#* If your CA does not yet have access to the CCADB, then you may request access here: https://ccadb.org/cas/request-access

#* '''[[CA/Information_Checklist#Create_a_Root_Inclusion_Case|Create a Root Inclusion Case in the CCADB]]''' - [https://ccadb-public.secure.force.com/mozilla/PrintViewForCase?CaseNumber=00000341 Example]

IMPORTANT: Note that all information submitted to our Bugzilla system is publicly available to anyone on the Internet. Please do not include proprietary or confidential information in your request. If you wish to discuss confidential or sensitive matters, please do so via private email to certificates@mozilla.org. Mozilla's process is public-facing, so all information that will be taken under consideration during the root inclusion request must be publicly available.

Here are the steps that a representative of the CA should take when asked to test that the certificate has been correctly imported and that websites work correctly.

# Click on the test build link that is provided, choose the download file for the operating system you are using. You only need to test on one operating system, because the root store changes will be the same across platforms.

#* For example, to test on Mac:

#** Find the line with OSX that contains "OS X..." and a green B.  

#** Click the green B, and the bottom part of the page will change to show more details of that build.

#** Click on the "Job Details" tab.

#** In the right column, you will see several "artifact uploaded" entries.

#** Scroll down that list to find "target.dmg". That's the Mac disk image that you're looking for. Click on it to download, then follow the instructions.

# It is very important to ensure that you test using a fresh profile, which can be done using either of the following approaches:

#* [https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings Refresh Firefox button] -- Recommended way to restore the security certificate settings.

#* [http://kb.mozillazine.org/Creating_a_new_Firefox_profile_on_Windows Create a new Firefox profile.]

#* For more information about using a separate profile for testing, refer to the knowledge base articles:  

#** [http://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles Profile Manager]

#** [https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean#w_corrupted-certificate-store Manually restore the security certificate settings] -- only perform as last resort.

# When you restart Firefox, be sure to use the test build that you just downloaded and installed. It will have a different name, like "Nightly".

#* If you are testing on a Mac OS you may need to:

#** [https://it.uoregon.edu/fix-security-settings Change the Gatekeeper settings] to allow 3rd party apps to be run. For details see {{Bug|1090459}}.

#** Open a Terminal window (Applications->Utilities->Terminal.app) and type: "sudo spctl --master-disable". You will have to enter your system password. Be sure to type "sudo spctl --master-enable" when you are done, to reset back to the regular protection. For details see {{Bug|1352203}}.

#** Pull down the Firefox menu (or name of the test build, e.g Nightly) and select Preferences...  

#* Click on your root certificate to highlight it, then click on "View..." to confirm the correct certificates (check Serial Number and Fingerprints), and then “Edit Trust…”  to verify that the correct trust bits are checked.

# Browse to websites that have TLS server certificates that chain up to this root cert. The appropriate UI should appear indicating it is a secure website. Click on the lock to view certificate details (">", "More Information", "View Certificate").

#* Note: EV-enablement is done in a separate bug, after the root has been included. So you will not see EV treatment during this testing.

* Notify Mozilla when its policies and business practices change in regard to verification procedures for issuing certificates, when the [[CA:RootTransferPolicy|ownership control of the CA’s certificate(s) changes]], or when ownership control of the CA’s operations changes.  

Additionally, CAs must maintain their data in the [https://ccadb.org Common CA Database] about:

* All certificates that are capable of being used to issue new certificates, and which directly or transitively chain to their certificate(s) included in Mozilla’s CA Certificate Program that are not technically constrained via EKU.

* Revoked certificates that were capable of being used to issue new certificates, and which directly or transitively chain to their certificate(s) included in Mozilla’s CA Certificate Program and were not technically constrained via EKU.