CA:SalesforceCommunity:MassImport: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Separated the tables to required and optional columns)
(redirect)
 
Line 1: Line 1:
= Automated Data Import =
#REDIRECT https://ccadb.org/cas/massimport
CAs who have a '''large''' number of intermediate certificates to add to the [http://ccadb.org/cas/intermediates CCADB] may request that their data be mass imported from a spreadsheet or CSV file, by sending email to their root store operator. Doing the mass import process involves a significant amount of manual work, so if you have less than 20 intermediate certificates please enter them by hand.
 
== Data Import Process ==
Intermediate certificate data may be automatically imported from a CSV file for one CA at a time. The data will first be imported into a test environment and checked, before it will be imported into production.
<br />
 
Within the CCADB we will load the CA's data from CSV file(s) into a staging object, which we've called "Migrate Certs". After the data is loaded into the staging object, we can view a staging record for each intermediate cert to be imported, and also view reports on that data. After checking the staging records, we will run a batch program that will read all records from the Migrate Certs object and process them in two steps.
Step one prepares a list of qualifying records for processing/reprocessing. Qualifying records are those that have not yet been migrated, and there is already a CCADB record for the Issuing certificate (parent).
Step two parses the PEM data of each item from the list and adds the corresponding intermediate certificate record. The batch program may be run multiple times to add child certs or after making data corrections.
<br />
 
When the batch program is no longer updating records, a report of the imported certs will be generated which indicates if the cert was imported or not, and the error if the cert was not imported. The report contains: Certificate Name, Parent Certificate Name, Processing Message/Error, X.509 Certificate (PEM).
<br />
 
For each of the errors, the CA will be responsible for [http://ccadb.org/cas/intermediates entering the intermediate certificate data] themselves
 
== Data Import Format ==
File Format: CSV or Excel Worksheet
 
'''Required Columns'''
{| class="wikitable"
|-
! Column/Field Name !! Valid Values !! Rules/Notes
|-
| PEM ||  "-----BEGIN CERTIFICATE----- <br /> <cert PEM data> <br /> -----END CERTIFICATE-----" || Cert PEM data must be enclosed in begin and end tags, and double quotes.
|-
| CA Owner/Certificate Name || Certificate Subject Common Name || Max 80 characters allowed. <br />  If the certificate does not have a Subject CN, then use the certificate Subject Organization. <br />  Note: A few additional characters may be added at the end of the name, for clarification purposes, but must be kept consistent within the hierarchy.
|-
| Parent CA Owner/Certificate || Certificate Issuer Common Name or Issuer Field || Max 80 characters allowed.
|-
| Parent Certificate's SHA-256 Fingerprint || Issuer Cert's SHA-256 Fingerprint || Required. Use this format: 74:F8:A3:C3:EF:E7:B3:90:06:4B:83:90:3C:21:64:60:20:E5:DF:CE
|-
|}
<br />
 
'''Optional Columns'''
{| class="wikitable"
|-
! Column/Field Name !! Valid Values !! Rules/Notes
|-
| Revocation Status || <blank> <br /> Revoked || Leave blank if not revoked. If this column and the other revocation-related columns are missing, then it will be assumed that the certs are not revoked.
|-
| Date of Revocation || <blank> <br /> MM/DD/YYYY || Leave blank if not revoked
|-
| RFC 5280 Revocation Reason Code || <blank> <br /> (0) unspecified <br /> (1) keyCompromise <br /> (2) cACompromise <br /> (3) affiliationChanged <br /> (4) superseded <br /> (5) cessationOfOperation <br /> (6) certificateHold <br /> (8) removeFromCRL <br /> (9) privilegeWithdrawn <br /> (10) aACompromise || Leave blank if not revoked
|-
| Audits Same as Parent || TRUE <br /> FALSE || TRUE if this certificate has the same audit information as the issuing certificate (or a subset). If TRUE, then leave the other audit-related columns empty. If this column and the other audit-related columns are missing, then it will be assumed that this value is TRUE.
|-
| Standard Audit || <blank> <br /> URL to audit statement || Leave blank if 'Audits Same as Parent' is TRUE. <br /> Max 255 characters allowed
|-
| Standard Audit Type || <blank> <br /> WebTrust <br /> ETSI TS 102 042 <br /> ETSI TS 101 456 || Leave blank if 'Audits Same as Parent' is TRUE
|-
| Standard Audit Statement Date || <blank> <br /> MM/DD/YYYY || Leave blank if 'Audits Same as Parent' is TRUE. Date that the audit statement was signed.
|-
| BR Audit || <blank> <br /> URL to BR audit statement  || Leave blank if 'Audits Same as Parent' is TRUE, or if Websites Trust Bit not enabled for the root, or cert not capable of issuing SSL/TLS certs.
|-
| BR Audit Type || <blank> <br /> WebTrust <br /> ETSI TS 102 042 || Leave blank if 'Audits Same as Parent' is TRUE
|-
| BR Audit Statement Date || <blank> <br /> MM/DD/YYYY || Leave blank if 'Audits Same as Parent' is TRUE. Date that the BR audit statement was signed.
|-
| EV Audit || <blank> <br /> URL to EV audit statement || Leave blank if 'Audits Same as Parent' is TRUE, or if Websites Trust Bit not enabled for the root, or if this cert is not capable of issuing EV SSL/TLS certs.
|-
| EV Audit Type || <blank> <br /> WebTrust <br /> ETSI TS 102 042 || Leave blank if 'Audits Same as Parent' is TRUE
|-
| EV Audit Statement Date || <blank> <br /> MM/DD/YYYY || Leave blank if 'Audits Same as Parent' is TRUE. Date that the EV audit statement was signed.
|-
| Auditor || <blank> <br /> Auditor's name  || Leave blank if 'Audits Same as Parent' is TRUE. Max 100 characters allowed
|-
| Auditor Website || <blank> <br /> URL to the auditor's website, or a site showing their affiliation, accreditation, or qualifications  || Leave blank if 'Audits Same as Parent' is TRUE. Max 300 characters allowed
|-
| Auditor Qualifications || <blank> <br /> URL to an attestation of the auditor's qualifications || Leave blank if 'Audits Same as Parent' is TRUE. Max 255 characters allowed
|-
| CP/CPS Same as Parent || TRUE <br /> FALSE || TRUE if this certificate has the same policy documentation as the issuing certificate (or a subset). If TRUE, then leave the other policy-related columns empty. If this column and the other CP/CPS columns are missing, then it will be assumed that this value is TRUE.
|-
| Policy Documentation || <blank> <br /> Notes about the documentation, such as which language the documents are in, or additional documents that need to be listed.  || Leave blank if 'CP/CPS Same as Parent' is TRUE. Max 1000 characters allowed
|-
| CA Document Repository || <blank> <br /> URL to the document repository pertaining to this certificate.  || Leave blank if 'CP/CPS Same as Parent' is TRUE. Max 255 characters allowed
|-
| Certificate Policy (CP) || <blank> <br /> URL to the Certificate Policy (CP) pertaining to this certificate.  || Leave blank if 'CP/CPS Same as Parent' is TRUE. Max 300 characters allowed
|-
| Certification Practice Statement (CPS) || <blank> <br /> URL to the Certificate Practice Statement (CPS) pertaining to this certificate.  || Leave blank if 'CP/CPS Same as Parent' is TRUE. Max 300 characters allowed
|-
| Public Comments || <blank> <br /> Any necessary additional information about the cert, audits, or CP/CPS || Max 2000 characters allowed
|-
|}

Latest revision as of 23:24, 26 September 2018

  1. REDIRECT https://ccadb.org/cas/massimport
Retrieved from "https://wiki.mozilla.org/index.php?title=CA:SalesforceCommunity:MassImport&oldid=1201630"