CA: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(More rearrangement)
m (→‎Program Administration: Changed description)
 
(120 intermediate revisions by 5 users not shown)
Line 2: Line 2:
= Mozilla's CA Certificate Program =
= Mozilla's CA Certificate Program =


Mozilla’s CA Certificate Program governs inclusion of root [https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates certificates] in [https://developer.mozilla.org/en-US/docs/NSS Network Security Services (NSS),] a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products.
Mozilla’s CA Certificate Program governs inclusion of root [https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates certificates] in [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS Network Security Services (NSS),] a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products. The program is overseen by the module owner and peers of the [[Modules/Activities#CA_Certificates|CA Certificates Module]];  the policy itself is overseen by the module owner and peers of the [[Modules/Activities#Mozilla_CA_Certificate_Policy|CA Certificate Policy Module]].
Here are a few blog posts that describe the Mozilla CA Certificate Program in further detail:
* [https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-own-root-certificate-store/ Why Does Mozilla Maintain a Root Store?]
* [https://blog.mozilla.org/security/2021/05/10/beware-of-applications-misusing-root-stores/ How to use Mozilla's Root Store properly]
 


== Policy ==
== Policy ==


* [http://www.mozilla.org/projects/security/certs/policy/ Root Store Policy] (current stable version: 2.4.1)
=== MRSP ===
* [[CA:Communications | CA Communications]] and their responses. Such communications may also set policy in advance of it being included in the Root Store Policy.
'''Mozilla Root Store Policy'''
* [https://github.com/mozilla/pkipolicy/issues Root Store Policy Issue Tracker]
* [https://www.mozilla.org/projects/security/certs/policy/ Root Store Policy] (current stable version: 3.0)
* [https://github.com/mozilla/pkipolicy/blob/master/rootstore/policy.md Latest draft of Root Store Policy] (will become the next version)
* [[CA:CertPolicy|Older versions of the Root Store Policy]]
* [[CA:BaselineRequirements|Baseline Requirements Compliance]]: Mozilla's expectations regarding compliance with the CA/Browser Forum's [https://cabforum.org/baseline-requirements-documents/ Baseline Requirements].
* [[CA:RootTransferPolicy|Root Transfer Policy]]: Mozilla's expectations when the ownership of an included root certificate changes, the organization operating the PKI changes, and/or the private keys of the root certificate are transferred to a new location.


== Lists of Certificates ==
* [[CA/Root_Store_Policy_Archive|Root Store Policy Archive]]
** Blog Posts Regarding Policy Updates  ([https://blog.mozilla.org/security/2025/03/12/enhancing-ca-practices-key-updates-in-mozilla-root-store-policy-v3-0/ MRSP v.3.0], [https://blog.mozilla.org/security/2023/09/13/version-2-9-of-the-mozilla-root-store-policy/ MRSP v.2.9], [https://blog.mozilla.org/security/2022/05/23/upgrading-mrsp-to-v-2-8/ MRSP v.2.8], [https://blog.mozilla.org/security/2021/04/26/mrsp-v-2-7-1/ MRSP v.2.7.1], [https://blog.mozilla.org/security/2020/07/09/reducing-tls-certificate-lifespans-to-398-days/ 398-day validity periods], [https://blog.mozilla.org/security/2019/12/11/announcing-version-2-7-of-the-mozilla-root-store-policy/ MRSP v.2.7], [https://blog.mozilla.org/security/2018/07/02/root-store-policy-updated/ MRSP v.2.6], [https://blog.mozilla.org/security/2017/09/07/mozilla-releases-version-2-5-root-store-policy/ MRSP v.2.5], [https://blog.mozilla.org/security/2017/04/04/mozilla-releases-version-2-4-ca-certificate-policy/ MRSP v.2.4], [https://blog.mozilla.org/security/2013/07/31/announcing-version-2-2-of-mozillas-ca-certificate-policy/ MRSP v.2.2])


* [[CA:IncludedCAs|Included CA Certificates]]
* [[CA/Communications | CA Communications]] and their responses. Such communications may also set policy in advance of it being included in the Root Store Policy.
* [[CA:RemovedCAcerts|Removed CA Certificates]]
** Blog Posts Regarding CA Communications ([https://blog.mozilla.org/security/2020/05/08/may-2020-ca-communication/ May 2020], [https://blog.mozilla.org/security/2020/01/13/january-2020-ca-communication/ Jan. 2020], [https://blog.mozilla.org/security/2018/09/17/september-2018-ca-communication/ Sept. 2018], [https://blog.mozilla.org/security/2017/11/16/november-2017-ca-communication/ Nov. 2017], [https://blog.mozilla.org/security/2016/03/29/march-2016-ca-communication/ Mar. 2016], [https://blog.mozilla.org/security/2015/05/12/may-2015-ca-communication/ May 2015])
* [[CA:PendingCAs|Pending CA Certificates]] or certificate trust bit/EV status changes
 
* [[CA/Dashboard|CA Request Dashboard]] - tracks applications and trust changes through the process
* [[CA/Updating_Root_Store_Policy|Process for updating the Root Store Policy]]
* [[NSS:Release_Versions | NSS:Release_Versions]] shows which product versions a particular root inclusion request was first available in
** [https://github.com/mozilla/pkipolicy/issues Root Store Policy Issue Tracker]
* [[CA:SubordinateCAcerts|Public Intermediate Certificates]]
** [https://github.com/mozilla/pkipolicy/labels/3.1 Issues for next version (3.1) of Root Store Policy] (will become the next version)
* [[CA:RevokedSubCAcerts|Revoked Intermediate Certificates]]
 
=== CCADB ===
'''Common CA Database (CCADB)'''
* [https://www.ccadb.org/policy CCADB Policy]
* [https://www.ccadb.org/cas/incident-report Incident Reporting Guidelines]
 
=== Certificate Transparency ===
* [[SecurityEngineering/Certificate_Transparency#CT_Policy | Certificate Transparency Policy]]
* [[SecurityEngineering/Certificate_Transparency#CT_Log_Policy | Certificate Transparency Log Policy]]
 
== Lists of CAs and Certificates ==
* [https://www.ccadb.org/rootstores/usage#ccadb-data-usage-terms Data Usage Terms]
* [[CA/Included_CAs|Included CAs]] (in the Root Program and in Firefox)
* [[CA/Included_Certificates|Included CA Certificates]] (Roots)
* [[CA/Intermediate_Certificates|Intermediate Certificates]]
** [https://blog.mozilla.org/security/2021/12/09/improved-quality-of-intermediate-certificates-with-enhanced-oversight-and-automation/ Improving the Quality of Publicly Trusted Intermediate CA Certificates with Enhanced Oversight and Automation]
** [https://blog.mozilla.org/security/2020/11/13/preloading-intermediate-ca-certificates-into-firefox/ Preloading Intermediate CA Certificates into Firefox]
* [[CA/Removed_Certificates|Removed CA Certificates]]
* [[NSS:Release_Versions|NSS Release Versions]] - shows in which version of Mozilla products each root certificate was first available
* [[CA/Additional_Trust_Changes| Additional Trust Policies ]] - describes trust policies enforced by PSM in Firefox and Thunderbird, but not represented in the NSS root store.


== Program Administration ==
== Program Administration ==


Most information relating to the administration of our program is stored either in [https://bugzilla.mozilla.org/ Bugzilla] or in the [[CA:CommonCADatabase|Common CA Database]].
Most information relating to the administration of our program is stored either in [https://bugzilla.mozilla.org/ Bugzilla] or in the [https://ccadb.org/ Common CA Database].
* [[CA/Bug_Triage|Bugzilla Bug Triage Process]] - also lists whiteboard tags
* [[CA/Dashboard|Certificate Change Request Dashboard]] - tracks inclusion requests and other trust changes in Bugzilla
* [[CA/Certificate_Change_Requests|Inclusion Requests]] as tracked in the CCADB
* [[CA/Incident_Dashboard|Incident and Compliance Dashboard]]
* [[CA/Maintenance_and_Enforcement#Issues_Lists|CA Issues Lists]]
* [[CA/CCADB_Dashboard|Dashboard of CCADB Enhancement Requests]]
** [[CA/Email_templates|Email Templates used by CCADB]]


* [[CA/ca-bugs|Lists of Mis-issuance Incident and Compliance Bugs]]
'''crt.sh'''
* [[CA_Bug_Triage|How we mark Bugzilla bugs related to the CA Certificate program]]
 
* [https://crt.sh/mozilla-disclosures Disclosure status of all certificates known to CT]
* [https://crt.sh/?cablint=issues Problematic certificates issued in the past week known to CT]
* [https://crt.sh/test-websites?trustedBy=Mozilla Test Websites] for Roots enabled with Mozilla's websites trust bit
* [https://crt.sh/mozilla-onecrl Mozilla's OneCRL]
 
== Information for Auditors ==
* [https://www.ccadb.org/auditors CCADB information for Auditors]
* [[CA/Audit_Statements|Audit Statement Requirements]]
* [https://www.ccadb.org/cas/alv Audit Letter Validation in CCADB]
* [[CA/Audit_Statements#Auditor_Qualifications|Auditor Qualifications]]
* [[CA/Auditor_Compliance|Auditor Compliance Dashboard]]
* [[CA/BR_Audit_Guidance|Guidance on doing Baseline Requirements audits]]
* [[CA/Transition_SMIME_BRs|Transition guidance for auditing to the S/MIME BRs]]
* [[CA/Auditor_Mistakes|Mistakes we have seen auditors make]] and their consequences


== Information for CAs ==
== Information for CAs ==
* [https://ccadb.org/cas/ CCADB Login]
* [https://ccadb.my.salesforce-sites.com/mozilla/CAAIdentifiersReport List of CAA Identifiers] (used to restrict issuance of certificates to specific CAs via a [https://tools.ietf.org/html/rfc6844 DNS Certification Authority Authorization Resource Record])
=== Compliance ===
* [[CA/Forbidden_or_Problematic_Practices|Forbidden or Problematic CA Practices]]
* [[CA/Required_or_Recommended_Practices|Required or Recommended CA Practices]]
* [[CA/Maintenance_and_Enforcement|Maintenance and Enforcement]]
* [[CA/Responding_To_An_Incident|Responding to an Incident]] (such as a misissuance)
* [[CA/Lessons_Learned| Lessons Learned]] - common compliance issues and proactive measures to prevent them
* [[CA/Vulnerability_Disclosure|Disclosing a Vulnerability or Security Incident]]
=== Root Inclusion ===
* [[CA/Root_Inclusion_Overview|Root Inclusion Overview]] '''<span style="color:red;">(New)</span>'''
* [[CA/Prioritization|Prioritization Criteria for Processing Root Inclusion Requests]]
* [[CA/Application_Process|Application Process for Mozilla's Root Program]]
* [[CA/Information_Checklist|CA Information Checklist]]
* [[CA/Quantifying_Value|Quantifying Value: Information Expected of New Applicants]]
* [[CA/Root_Inclusion_Considerations|Root Inclusion Considerations]] -- Additional criteria to consider in adding or removing a root certificate
* [[CA/Compliance_Self-Assessment|Compliance Self Assessment]]
* [[CA/CPS_Review|Previous reviews of CP/CPS documents]]
* [[CA/Dashboard|Inclusion Requests - Bugzilla Dashboard]]
=== Subordinate CAs ===
* [[CA/Subordinate_CA_Checklist|Subordinate CA Information Checklist]]
* [[CA/External_Sub_CAs|Approval Process for Externally Operated Subordinate CAs]]


* [[CA/Application_Process|Application Process Overview]]
=== Root Removal and Other Root Changes ===
* [[CA:How_to_apply|How To Apply]]
* [[CA/Certificate_Change_Process|Change or Remove an Included Root Certificate]]
* [[CA:Root_Change_Process|Making Changes to Included Roots]]
* [[CA/Root_CA_Lifecycles|Root CA Lifecycles]]
 
=== Revocation ===
* [[CA/Revocation_Reasons|Revocation Reasons for TLS Server Certificates]]
** [https://blog.mozilla.org/security/2022/05/16/revocation-reason-codes-for-tls-server-certificates/ Revocation Reasons Blog Post]
* [[CA/Responding_To_An_Incident#Revocation|Delayed Revocation Incidents]]
* [[CA/Mass_Revocation_Events|Guidance for Complying with MRSP 6.1.3 - Mass Revocation Planning]]
 
== How Firefox Works ==
* [[SecurityEngineering/Certificate_Verification|How Firefox Performs Certificate Verification]] and path construction
* [[CA/EV_Processing_for_CAs | How Firefox Processes EV Certificates]]
* [[CA/Revocation_Checking_in_Firefox|How Firefox Performs Revocation Checking]]
 
== Tools to Check Certificates ==
* [https://www.ssllabs.com/ssltest/analyze.html SSL Labs Server Quality Checker]
* [https://observatory.mozilla.org/ Mozilla SSL Server Quality Checker]
* [[PSM:EV_Testing_Easy_Version|EV Readiness Test]]
* [https://certviewer-dot-ccadb-231121.appspot.com/certviewer Certificate Viewer] -- can also be installed/run locally (see [https://github.com/mozilla/CCADB-Tools/tree/master/certViewer ReadMe])
* [https://certificate.revocationcheck.com/ Certificate Revocation Checker] (also checks CRL and OCSP server quality and compliance)
** [[CA:TestErrors|Explanation of errors encountered during certificate testing]]
 
=== Certificate Linters ===
* [https://github.com/pkimetal/pkimetal PKI Meta-Linter] Access multiple linters via a single REST API call
* [https://github.com/digicert/pkilint PKI Lint Tool for TLS & S/MIME] - GitHub
* [https://github.com/certlint/certlint BR Lint Certificate Test] - GitHub
* [https://github.com/zmap/zlint ZLint - Certificate Test of Mozilla's and others' requirements] - GitHub
* [https://github.com/kroeckx/x509lint X.509 Lint Certificate Test] - GitHub
 
== Information for the Public ==
* [[CA/Terminology|Glossary of CA and Certificate Terminology]]
* [https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-own-root-certificate-store/ Why Does Mozilla Maintain Our Own Root Certificate Store?]
* [https://blog.mozilla.org/security/2019/04/15/common-ca-database-ccadb/ What is the Common CA Database (CCADB)?]
* [[CA/FAQ|FAQ About Certificates and CAs]]
* [https://ccadb.my.salesforce-sites.com/mozilla/ProblemReportingMechanismsReport List of CA problem reporting mechanisms (email, etc.)] (use this to report a certificate problem directly to the CA)
* [https://bugzilla.mozilla.org/enter_bug.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance Report an Incident to Mozilla] (be sure to click the "Security" checkbox if it is a [https://www.mozilla.org/en-US/security/#For_Developers security-sensitive incident])
 
'''Configuring Firefox'''
* [[CA/AddRootToFirefox|How to install your own root certificate in Firefox]]
** [[CA/Changing_Trust_Settings#Trusting_an_Additional_Root_Certificate|Manually import a root certificate into Firefox]]
* [[CA/Changing_Trust_Settings|Changing Certificate Trust Settings in Firefox]]


* [[CA:Recommended_Practices|Recommended CA practices]]
* [[CA:Problematic_Practices|Potentially problematic CA practices]]
* [[CA:BRs-Self-Assessment|How to do a self-assessment against the Baseline Requirements (BRs)]]


== Discussion Forums ==
== Discussion Forums ==


The following Mozilla public forums are relevant to CA evaluation and related issues. Each forum can be accessed either as a mailing list, over the web or as a newsgroup.
The following public forums are relevant to CA evaluation and related issues.  
 
===== CCADB =====
* '''[https://groups.google.com/a/ccadb.org/g/public CCADB Public mailing list''' is used to conduct a six-week public discussion of CA root inclusion requests and to discuss important lessons learned from CA incident reports. See https://www.ccadb.org/cas/public-group for more information.
 
===== MDSP =====
* '''[https://groups.google.com/a/mozilla.org/g/dev-security-policy Mozilla's dev-security-policy (MDSP)] mailing list''' is used for discussions of Mozilla policies related to security in general and CAs in particular, and for wider discussions about the WebPKI. If you are a regular participant in MDSP, then please add your name to the [[CA/Policy_Participants|Policy Participants]] page.


* [https://www.mozilla.org/en-US/about/forums/#dev-security-policy mozilla.dev.security.policy] (MDSP). This forum is used for discussions of Mozilla policies related to security in general and CAs in particular, and for wider discussions about the WebPKI. Among other things, it is the preferred forum for the public comment phase of CA evaluation. If you are a regular participant in MDSP, then please add your name to the [[CA:Policy_Participants|Policy Participants]] page.
===== Other MDSP Mail Archives =====
* [https://www.mozilla.org/en-US/about/forums/#dev-tech-crypto mozilla.dev.tech.crypto]. This forum is used for discussions of the [http://www.mozilla.org/projects/security/pki/nss/ NSS] cryptographic library used in Firefox and other Mozilla-based products, as well as the [http://www.mozilla.org/projects/security/pki/psm/ PSM] module that implements higher-level security protocols for Firefox.
* '''New MDSP Messages''' (since August 2021)
* [https://www.mozilla.org/en-US/about/forums/#dev-security mozilla.dev.security]. This forum is used for discussions of Mozilla security issues in general.


== Override Default Trust Settings in Firefox ==
(HTML): https://www.mail-archive.com/dev-security-policy@mozilla.org/


Users of Firefox or other Mozilla products may [[CA:UserCertDB|override the default root certificate settings]] by either deleting root certificates or by changing the trust bit settings of a root certificate.
(RSS): https://www.mail-archive.com/dev-security-policy@mozilla.org/maillist.xml


== How to Apply for Root Inclusion or Changes ==
* '''Old MDSP Messages''' (until April 2021)


* [https://wiki.mozilla.org/CA Process Overview]
(HTML): https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/
* [[CA:How_to_apply|How to Apply]] -- A guide for CAs wishing to include their certificate in Mozilla's Root CA store, and also a guide for CAs wishing to add trust bits or enable EV for a certificate that is already included in Mozilla's Root CA store.
* [[CA:Root_Change_Process|Root Change Process]] -- How to request a change to a root certificate that is currently included in NSS. This includes the process for disabling or removing a root certificate from NSS.


* [[CA:Information_checklist|Checklist of CA information]] required to process a CA's application
(RSS): https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/maillist.xml
* [[CA:Recommended_Practices|Recommended practices for CAs]] wishing to have their root CA certificates included in Mozilla products
* [[CA:Problematic_Practices|Potentially problematic CA practices]]. This discusses CA practices that are not explicitly forbidden by the Mozilla CA policy, and do not necessarily pose security issues, but that some people have expressed concerns about and that may cause delays in evaluating and approving CA applications. Some of these practices may be addressed in future versions of the Mozilla CA policy.
* [[CA:Schedule|Queue for Public Discussion]] of CA evaluations
* [[CA:Recommendations_for_Roots|Technical recommendations for root certificates]]. This is a very first-cut attempt to outline what root certificates should contain, based on the relevant RFCs as supplemented by existing practices.
* [[CA:SubordinateCA_checklist|Checklist for Subordinate CAs and CSPs]] Information needed when subordinate CAs are operated by third parties.


* [[PSM:EV_Testing_Easy_Version | EV Testing in Firefox:]] Explains how you can test that your CA certificate (that you want to enable for EV) and your OCSP infrastructure is working correctly according to the expectations of Mozilla, Firefox, the NSS library, and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software).
===== Other Forums =====
** [[CA:EV_Revocation_Checking|EV certificates and revocation checking]]. This discusses how revocation checking via OCSP or CRLs affects the UI treatment of EV certificates.
* [https://groups.google.com/a/mozilla.org/g/dev-tech-crypto Mozilla's dev-tech-crypto] mailing list is used for discussions of the [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS NSS] cryptographic library used in Firefox and other Mozilla-based products, as well as the [https://www.mozilla.org/projects/security/pki/psm/ PSM] module that implements higher-level security protocols for Firefox.
* Terminology
* For other discussions of Mozilla security issues:
** [[CA:Glossary|Glossary of CA- and Mozilla-related terms]]. Useful for following Mozilla CA-related discussions.
** [https://discourse.mozilla.org/c/security/ Mozilla's Security Web forum] is a place to discuss information security work in the open source space, where Mozilla is empowering users to build and curate a Healthy Internet.
** [[CA:Terminology | High Level Terminology]]
** [https://discourse.mozilla.org/tags/c/firefox-development/privacy-and-security Mozilla's privacy-and-security forum] is a place to discuss issues and questions specific to privacy and security.
* [[CA:Certificate Download Specification|Certificate download specification]]. This document describes the data formats used by Mozilla products for installing certificates.
** [https://chat.mozilla.org/#/room/#security:mozilla.org chat on Matrix] may also be used

Latest revision as of 00:21, 2 December 2025

Mozilla's CA Certificate Program

Mozilla’s CA Certificate Program governs inclusion of root certificates in Network Security Services (NSS), a set of open source libraries designed to support cross-platform development of security-enabled client and server applications. The NSS root certificate store is not only used in Mozilla products such as the Firefox browser, but is also used by other companies in a variety of products. The program is overseen by the module owner and peers of the CA Certificates Module; the policy itself is overseen by the module owner and peers of the CA Certificate Policy Module. Here are a few blog posts that describe the Mozilla CA Certificate Program in further detail:


Policy

MRSP

Mozilla Root Store Policy

CCADB

Common CA Database (CCADB)

Certificate Transparency

Lists of CAs and Certificates

Program Administration

Most information relating to the administration of our program is stored either in Bugzilla or in the Common CA Database.

crt.sh

Information for Auditors

Information for CAs

Compliance

Root Inclusion

Subordinate CAs

Root Removal and Other Root Changes

Revocation

How Firefox Works

Tools to Check Certificates

Certificate Linters

Information for the Public

Configuring Firefox


Discussion Forums

The following public forums are relevant to CA evaluation and related issues.

CCADB
MDSP
  • Mozilla's dev-security-policy (MDSP) mailing list is used for discussions of Mozilla policies related to security in general and CAs in particular, and for wider discussions about the WebPKI. If you are a regular participant in MDSP, then please add your name to the Policy Participants page.
Other MDSP Mail Archives
  • New MDSP Messages (since August 2021)

(HTML): https://www.mail-archive.com/dev-security-policy@mozilla.org/

(RSS): https://www.mail-archive.com/dev-security-policy@mozilla.org/maillist.xml

  • Old MDSP Messages (until April 2021)

(HTML): https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/

(RSS): https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/maillist.xml

Other Forums
  • Mozilla's dev-tech-crypto mailing list is used for discussions of the NSS cryptographic library used in Firefox and other Mozilla-based products, as well as the PSM module that implements higher-level security protocols for Firefox.
  • For other discussions of Mozilla security issues:
Retrieved from "https://wiki.mozilla.org/index.php?title=CA&oldid=1255828"