Confirmed users
681
edits
CA/External Sub CAs: Difference between revisions
Edits to hyperlinks
m (minor edit) |
(Edits to hyperlinks) |
||
| Line 11: | Line 11: | ||
The root CA operator MUST complete the following process and receive written approval from Mozilla before a non-technically-constrained (according to [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy#53-intermediate-certificates MRSP section 5.3]) externally-operated subordinate CA begins issuing certificates under the conditions stated in section 8.4 of [https://www.mozilla.org/projects/security/certs/policy/ MRSP]. | The root CA operator MUST complete the following process and receive written approval from Mozilla before a non-technically-constrained (according to [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy#53-intermediate-certificates MRSP section 5.3]) externally-operated subordinate CA begins issuing certificates under the conditions stated in section 8.4 of [https://www.mozilla.org/projects/security/certs/policy/ MRSP]. | ||
This approval process is essentially the same approval [CA/Application_Process#Process_Overview process used for root inclusion requests], with the main difference being that the root CA operator collects the information from the potential subordinate CA operator, creates a corresponding Bugzilla Bug, and provides the results of their own detailed review. Then a Mozilla representative or a CA Community representative (as agreed by the Mozilla representative) will perform an additional detailed review of the subordinate CA’s CP/CPS and audit documents and provide their findings in the Bugzilla Bug. Then a representative of Mozilla starts a discussion in [https://groups.google.com/a/mozilla.org/g/dev-security-policy MDSP] as described in the [[CA/External_Sub_CAs#Public_Discussion|Public Discussion]] section below. | This approval process is essentially the same approval [[CA/Application_Process#Process_Overview process used for root inclusion requests]], with the main difference being that the root CA operator collects the information from the potential subordinate CA operator, creates a corresponding Bugzilla Bug, and provides the results of their own detailed review. Then a Mozilla representative or a CA Community representative (as agreed by the Mozilla representative) will perform an additional detailed review of the subordinate CA’s CP/CPS and audit documents and provide their findings in the Bugzilla Bug. Then a representative of Mozilla starts a discussion in [https://groups.google.com/a/mozilla.org/g/dev-security-policy MDSP] as described in the [[CA/External_Sub_CAs#Public_Discussion|Public Discussion]] section below. | ||
Approval of one type of certificate issuance (e.g. email) for a subordinate CA operator does '''not''' imply that another type of certificate issuance (e.g. TLS) would be approved for the same CA operator. | Approval of one type of certificate issuance (e.g. email) for a subordinate CA operator does '''not''' imply that another type of certificate issuance (e.g. TLS) would be approved for the same CA operator. | ||
| Line 21: | Line 21: | ||
! '''Step''' !! Who performs this step !! Equivalent Step(s) in Mozilla’s root Inclusion Process | ! '''Step''' !! Who performs this step !! Equivalent Step(s) in Mozilla’s root Inclusion Process | ||
|- | |- | ||
| Create a [[ | | Create a [[#Bugzilla_Bug|Bugzilla Bug]] containing the [[#Required_Documentation|required documentation]] about the potential subordinate CA operator || Root CA Operator || 1 and 2 | ||
|- | |- | ||
| Perform a [CA/Application_Verification#Detailed_Review detailed review] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug. The potential Subordinate CA operator may update their documentation based on the Root CA operator’s findings, and this step may be re-performed. || Root CA Operator || 3 | | Perform a [[CA/Application_Verification#Detailed_Review detailed review]] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug. The potential Subordinate CA operator may update their documentation based on the Root CA operator’s findings, and this step may be re-performed. || Root CA Operator || 3 | ||
|- | |- | ||
| Update the Bugzilla Bug to indicate that it is ready for Mozilla review. '''Set "Whiteboard"''' to "[subca-cps-review]" and '''Set "Request Information From"''' to bwilson@mozilla.com || Root CA Operator || | | Update the Bugzilla Bug to indicate that it is ready for Mozilla review. '''Set "Whiteboard"''' to "[subca-cps-review]" and '''Set "Request Information From"''' to bwilson@mozilla.com || Root CA Operator || | ||
|- | |- | ||
| Perform a [CA/Application_Verification#Detailed_Review detailed review] of the potential subordinate CA’s policy and audit documents, provide and summarize the findings in the Bugzilla Bug. || '''Representative of Mozilla''' | | Perform a [[CA/Application_Verification#Detailed_Review detailed review]] of the potential subordinate CA’s policy and audit documents, provide and summarize the findings in the Bugzilla Bug. || '''Representative of Mozilla''' | ||
or of the CA Community (as agreed by a Mozilla representative) | or of the CA Community (as agreed by a Mozilla representative) | ||
|| 3 | || 3 | ||
| Line 79: | Line 79: | ||
5. CP, CPS, or CP/CPS for the operation of the subordinate CA | 5. CP, CPS, or CP/CPS for the operation of the subordinate CA | ||
6. Audit statements, [CA/Audit_Statements#Providing_Auditor_Qualifications auditor information and qualifications] | 6. Audit statements, [[CA/Audit_Statements#Providing_Auditor_Qualifications auditor information and qualifications]] | ||
a. May be uploaded as an attachment to the [[CA/External_Sub_CAs#Bugzilla_Bug|Bugzilla Bug]] | a. May be uploaded as an attachment to the [[CA/External_Sub_CAs#Bugzilla_Bug|Bugzilla Bug]] | ||
| Line 89: | Line 89: | ||
d. If key generation has already occurred, then the root CA operator should provide a copy of the relevant auditor-supplied documentation (e.g. a key generation report). | d. If key generation has already occurred, then the root CA operator should provide a copy of the relevant auditor-supplied documentation (e.g. a key generation report). | ||
7. The subordinate CA’s [CA/Compliance_Self-Assessment Compliance Self-Assessment] | 7. The subordinate CA’s [[CA/Compliance_Self-Assessment Compliance Self-Assessment]] | ||
8. The results of the root CA operator’s detailed policy and audit review for the subordinate CA | 8. The results of the root CA operator’s detailed policy and audit review for the subordinate CA | ||
9. Explanation about why this subordinate CA is needed, e.g. [CA/Quantifying_Value Value Justification]. For example, the primary reason in the explanation can be that: | 9. Explanation about why this subordinate CA is needed, e.g. [[CA/Quantifying_Value Value Justification]]. For example, the primary reason in the explanation can be that: | ||
a. a large enterprise wants to manage the certificates for domains that they own, or. | a. a large enterprise wants to manage the certificates for domains that they own, or. | ||
| Line 101: | Line 101: | ||
== Public Discussion == | == Public Discussion == | ||
Prior to public discussion on the [https://groups.google.com/a/mozilla.org/g/dev-security-policy Mozilla dev-security-policy mailing list], the root CA operator must attest that it has verified all of the [[CA/External_Sub_CAs#Required_Documentation|required documentation]]. A Representative of Mozilla or of the CA Community (as agreed by a Mozilla representative) will perform a separate and independent [CA/Application_Verification#Detailed_Review detailed review] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug before starting the discussion. | Prior to public discussion on the [https://groups.google.com/a/mozilla.org/g/dev-security-policy Mozilla dev-security-policy mailing list], the root CA operator must attest that it has verified all of the [[CA/External_Sub_CAs#Required_Documentation|required documentation]]. A Representative of Mozilla or of the CA Community (as agreed by a Mozilla representative) will perform a separate and independent [[CA/Application_Verification#Detailed_Review detailed review]] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug before starting the discussion. | ||
If Mozilla approves the subordinate CA operator, a representative of Mozilla will: | If Mozilla approves the subordinate CA operator, a representative of Mozilla will: | ||