Confirmed users
678
edits
CA/External Sub CAs: Difference between revisions
→Process for non-Technically-Constrained Subordinate CAs: Minor edits
(→Process for non-Technically-Constrained Subordinate CAs: Minor clarifications) |
(→Process for non-Technically-Constrained Subordinate CAs: Minor edits) |
||
| Line 25: | Line 25: | ||
| Perform a [[CA/Application_Verification#Detailed_Review|detailed review]] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug. The potential Subordinate CA operator may update their documentation based on the Root CA operator’s findings, and this step may be re-performed. Then provide a summary of the detailed policy review, audit documents, and other findings in the Bugzilla Bug. || Root CA Operator || 3 | | Perform a [[CA/Application_Verification#Detailed_Review|detailed review]] of the potential subordinate CA’s policy and audit documents, and provide findings in the Bugzilla Bug. The potential Subordinate CA operator may update their documentation based on the Root CA operator’s findings, and this step may be re-performed. Then provide a summary of the detailed policy review, audit documents, and other findings in the Bugzilla Bug. || Root CA Operator || 3 | ||
|- | |- | ||
| Start a [[CA/External_Sub_CAs#Public_Discussion|3-week public discussion]] in [https://groups.google.com/a/mozilla.org/g/dev-security-policy MDSP] or [https://groups.google.com/a/ccadb.org/g/public CCADB Public] summarizing the request and providing links to the documentation and evaluations performed. || | | Start a [[CA/External_Sub_CAs#Public_Discussion|3-week public discussion]] in [https://groups.google.com/a/mozilla.org/g/dev-security-policy MDSP] or [https://groups.google.com/a/ccadb.org/g/public CCADB Public] summarizing the request and providing links to the documentation and evaluations performed. || Root CA Operator || 4 | ||
|- | |- | ||
| Discussion proceeds, and the root CA Operator and the externally-operated subordinate CA operator respond to questions and concerns || Root CA Operator and subordinate CA operator || 5 | | Discussion proceeds, and the root CA Operator and the externally-operated subordinate CA operator respond to questions and concerns || Root CA Operator and subordinate CA operator || 5 | ||
|- | |- | ||
| Summarize the results of the discussion and provide decision in the discussion thread and in the Bugzilla Bug || | | Summarize the results of the discussion and provide decision in the discussion thread and in the Bugzilla Bug || Representative of Mozilla || 6, 7 | ||
(Steps 8-14 are not relevant to intermediate CA certificates) | (Steps 8-14 are not relevant to intermediate CA certificates) | ||
| Line 35: | Line 35: | ||
| Add the subordinate CA certificate(s) to the CCADB, if it was not previously added according to [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy#53-intermediate-certificates MRSP section 5.3].** || Root CA Operator || 15 | | Add the subordinate CA certificate(s) to the CCADB, if it was not previously added according to [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy#53-intermediate-certificates MRSP section 5.3].** || Root CA Operator || 15 | ||
|- | |- | ||
| Update the appropriate fields for the CA certificate(s) in the CCADB to indicate that public discussion occurred and that the CA was approved || | | Update the appropriate fields for the CA certificate(s) in the CCADB to indicate that public discussion occurred and that the CA was approved || Representative of Mozilla || | ||
|- | |- | ||
| Update the corresponding records in the CCADB at least annually with current policy and audit documentation. || Root CA Operator || | | Update the corresponding records in the CCADB at least annually with current policy and audit documentation. || Root CA Operator || | ||
|} | |} | ||
<nowiki>**</nowiki> Public disclosure of new CA certificates in the CCADB must occur within | <nowiki>**</nowiki> Public disclosure of new CA certificates in the CCADB must occur within seven days of signing the CA certificate as required by [https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#532-publicly-disclosed-and-audited MRSP § 5.3.2], including an indication of whether the CA is covered by the same audits as the parent CA or whether it has a separate audit. | ||
== Bugzilla Bug == | == Bugzilla Bug == | ||