Confirmed users, Administrators
5,526
edits
CA/Subordinate CA Checklist: Difference between revisions
→Subordinate CAs Operated by Third Parties For External Use
| Line 36: | Line 36: | ||
# If the root CA audit does not include this sub-CA, then for this sub-CA provide a publishable statement or letter from an auditor that meets the requirements of sections 8, 9, and 10 of our [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA certificate policy.] | # If the root CA audit does not include this sub-CA, then for this sub-CA provide a publishable statement or letter from an auditor that meets the requirements of sections 8, 9, and 10 of our [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA certificate policy.] | ||
# Provide information about the CRL update frequency for end-entity certificates. There should be a statement in the CP/CPS that the sub-CA must follow to the effect that the CRL for end-entity certs is updated whenever a cert is revoked, and at least every 24 or 36 hours. | # Provide information about the CRL update frequency for end-entity certificates. There should be a statement in the CP/CPS that the sub-CA must follow to the effect that the CRL for end-entity certs is updated whenever a cert is revoked, and at least every 24 or 36 hours. | ||
# If this sub-CA provides OCSP, then a test must be done to make sure that their OCSP responder works within the Firefox browser. Provide the url to a website whose SSL cert chains up to this sub-CA and has the AIA extension referencing the OCSP responder. The Mozilla representative will perform the following check: | |||
#* Enforce OCSP in Firefox: Tools->Options…->Advanced->Encryption->Validation | |||
#* Select the box for “When an OCSP server connection fails, treat the certificate as invalid” | |||
#* Browse to the given url. Ensure that the website loads without error into Firefox, and that it's SSL cert chains up to the sub-CA and references the OCSP responder in the AIA extension. | |||