Confirmed users
681
edits
CA/External Sub CAs: Difference between revisions
→Required Documentation: Highlighted that the root CA operator must publicly provide the documentation
m (→Summary: Minor edits) |
(→Required Documentation: Highlighted that the root CA operator must publicly provide the documentation) |
||
| Line 43: | Line 43: | ||
SubCA audits must follow the same audit rules as for root CAs. If the subCA is new, root CA operator need only supply a point-in-time audit statement to Mozilla prior to approval. The new subCA certificate must appear in subsequent period-of-time audit statements, but is not required to appear on the statements submitted to Mozilla for approval, so long as the root CA asserts that the subCA will be operated within the scope of the supplied audit statements. | SubCA audits must follow the same audit rules as for root CAs. If the subCA is new, root CA operator need only supply a point-in-time audit statement to Mozilla prior to approval. The new subCA certificate must appear in subsequent period-of-time audit statements, but is not required to appear on the statements submitted to Mozilla for approval, so long as the root CA asserts that the subCA will be operated within the scope of the supplied audit statements. | ||
Prior to public discussion, the root CA operator must confirm that it has verified all of the following information, which must be provided when the root CA operator starts the public discussion | Prior to public discussion, the root CA operator must confirm that it has verified all of the following information, '''which must be provided for public review in, or as attachments to, the Bugzilla bug''' when the root CA operator starts the public discussion on the [https://groups.google.com/a/mozilla.org/g/dev-security-policy Mozilla dev-security-policy mailing list]: | ||
1. External Third Party’s Full Legal Name; | 1. External Third Party’s Full Legal Name; | ||
| Line 55: | Line 55: | ||
5. Links to the subCA’s current CP/CPS; and | 5. Links to the subCA’s current CP/CPS; and | ||
6. The root CA operator | 6. The root CA operator's review of the subCA operator’s practices (e.g. the CP and CPS), including the completed [[CA/Compliance_Self-Assessment|Compliance Self-Assessment]]. | ||
After a minimum of 3 weeks have passed, a Mozilla representative will announce a one-week “last call” for objections. Mozilla may determine to extend public discussion, or approve or reject the subCA operator. If the subCA operator is approved, Mozilla will indicate in the appropriate fields of the CCADB that the public discussion process has taken place and that it has been approved as an externally operated CA. Issuance of end entity certificates from the subCA may then commence. If the subCA is rejected, then any existing subCA certificate will be added to [https://crt.sh/mozilla-onecrl OneCRL]. | After a minimum of 3 weeks have passed, a Mozilla representative will announce a one-week “last call” for objections. Mozilla may determine to extend public discussion, or approve or reject the subCA operator. If the subCA operator is approved, Mozilla will indicate in the appropriate fields of the CCADB that the public discussion process has taken place and that it has been approved as an externally operated CA. Issuance of end entity certificates from the subCA may then commence. If the subCA is rejected, then any existing subCA certificate will be added to [https://crt.sh/mozilla-onecrl OneCRL]. | ||