Confirmed users, Administrators
5,526
edits
CA/Subordinate CA Checklist: Difference between revisions
→Subordinate CAs Operated by Third Parties For Internal Use
(Requirements for Subordinate CAs Operated by Third Parties) |
|||
| Line 14: | Line 14: | ||
#*Who can perform the audits for sub-CAs. | #*Who can perform the audits for sub-CAs. | ||
#*Frequency of the audits for sub-CAs. | #*Frequency of the audits for sub-CAs. | ||
== Subordinate CAs Operated by Third Parties For External Use == | |||
This section applies when your root signs subordinate CAs for companies who use the sub-CA to sign other sub-CAs or certificates for other companies or individuals not affiliated with their company. For instance, this section applies to you if your root issues sub-CAs that are used by Certificate Service Providers (CSP). | |||
In addition to the information listed above, you will also need to provide the following information for each CSP. | |||
# Sub-CA Company Name | |||
# Sub-CA Corporate URL | |||
# CA hierarchy under the sub-CA. | |||
# Sub-CA CP/CPS Links | |||
# The section numbers and text (in English) in the CP/CPS that demonstrate that reasonable measures are taken to verify the ownership of the domain name and email address for end-entity certificates chaining up to the root, as per section 7 of our [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA certificate policy]. | |||
#* domain ownership/control | |||
#* email address ownership/control | |||
#* digitally signing code objects -- entity submitting the certificate signing request is the same entity referenced in the certificate | |||
# Identify if the SSL certificates chaining up to this root are DV and/or OV. Some of the potentially problematic practices, only apply to DV certificates. | |||
#* DV: Organization attribute is not verified. Only the Domain Name referenced in the certificate is verified to be owned/controlled by the subscriber. | |||
#* OV: Both the Organization and the ownership/control of the Domain Name are verified. | |||
# Review the CP/CPS for potentially problematic practices, as per [http://wiki.mozilla.org/CA:Problematic_Practices Potentially Problematic Practices.] Provide further info when a potentially problematic practice is found. | |||
# If the root CA audit does not include this sub-CA, then for this sub-CA provide a publishable statement or letter from an auditor that meets the requirements of sections 8, 9, and 10 of our [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA certificate policy]. | |||
# Provide information about the CRL update frequency for end-entity certificates. There should be a statement in the CP/CPS to the effect that the CRL for end-entity certs is updated whenever a cert is revoked, and at least every 24 or 36 hours. | |||