CA/Subordinate CA Checklist

Subordinate CAs Operated by Third Parties For Internal Use

When your root signs subordinate CAs for enterprises/companies who operate the sub-CA for their own use, the following information needs to be publicly available.

1. General description of the sub-CAs operated by third parties.
2. The Certificate Practice Statement and Policy that the sub-CAs are required to follow.
3. Requirements (technical and contractual) for sub-CAs in regards to whether or not sub-CAs are constrained to issue certificates only within certain domains, and whether or not sub-CAs can create their own subordinates.
4. Requirements for sub-CAs to take reasonable measures to verify the ownership of the domain name and email address for end-entity certificates chaining up to the root, as per section 7 of our Mozilla CA certificate policy.
   • domain ownership/control
   • email address ownership/control
   • digitally signing code objects -- entity submitting the certificate signing request is the same entity referenced in the certificate
5. Description of audit requirements for sub-CAs
   • Whether or not the root CA audit includes the sub-CAs.
   • Who can perform the audits for sub-CAs.
   • Frequency of the audits for sub-CAs.