CA/Lessons Learned
< CA
Jump to navigation
Jump to search
|
THIS PAGE IS A WORKING DRAFT | 
|
| The page may be difficult to navigate, and some information on its subject might be incomplete and/or evolving rapidly. If you have any questions or ideas, please add them as a new topic on the discussion page. |
| Incorrect Certificate Profiles and Misconfigured Certificates | |
|---|---|
| Compliance Issue or Root Cause | Mitigation Strategies |
| General Issues of Non-Compliance
(e.g. certificates that do not comply with CA/B Forum requirements or Mozilla Policy) |
Closely monitor changes in requirements; conduct regular audits and reviews; provide training; implement automated compliance tools |
| Certificate Profile Errors
(see below - certificates issued with profiles not adhering to requirements, certificates with incorrect Subject attribute order, incorrect key usages, etc.) |
Use standardized templates that have been validated against CABF and Mozilla requirements; automate the profile validation process |
| Duplicate Serial Numbers
Bug #s 1636140, 1677737 |
Unique serial number generation; database checks; eliminate the potential that certificate orders remain in the issuance queue when re-starting or re-configuring CA systems; generate the final certificate immediately upon receipt of the SCTs; |
| Insufficient Serial Number Entropy | Check entropy with pre-issuance linting; specify more entropy than is required; follow cryptographic best practices; keep CA software up to date; test CA software for compliance with requirements; provide developers with training on the proper calculation of entropy; |
| Improper Key Usage
Bug #s 1756122, 1647468, 1667448, 1703528 |
Pre-issuance linting; check keyUsage configuration in certificate profiles using automated tools; review section 7 of the Baseline Requirements; implement dual control for certificate template changes; |
| Invalid CN/SAN Entries
Bug #s 1687139, 1705187, 1716123, 1462423, 1897346 |
Pre-issuance linting; implement automated checks for CN and SAN matching; conduct code review and system testing; |
| Invalid Certificate Extensions/Non-Standard Extensions
Bug #s 1899466, 1876565, 1498463, 1524451 |
Implement strict validation processes to detect and reject non-standard extensions; stay updated on revisions to requirements; implement pre-issuance linting; |
| Invalid OrganizationIdentifier
Bug #s 1897538, 1898986, 1769240, 1900492 |
Write detailed specifications; conduct code review; improve training and internal communications; improve linting; update validation scheme logic; replace manual processes with automation; |
| Overly Long Certificate Lifetimes/Validity Periods
Bug #s 1826713, 1774418, 1676352 |
Keep certificate profile management system updated; review certificate profiles on system startup; implement pre-issuance linting; set maximum validity periods to much less than that allowed by the requirements; don’t give credits for early certificate renewals; |
| Use of Deprecated or Incorrect Algorithms
Bug #s 1648472, 1793441, 1664328, |
Stay up-to-date with approved algorithms listed in requirements; conduct detailed certificate profile checks, and use automation where feasible; update system logic so that it selects the correct algorithm; implement pre-issuance linting; |
| Wildcard Mis-issuance
Bug #s 1446121, 1528263, 1782391, 1731939, |
Block wildcards in EV certificates; ensure proper syntax and ASN.1 encoding per RFC 5280; implement pre-issuance linting; |
| Incorrect Certificate Subject Details | |
| Invalid Organization Information
Bug #s 1680083, 1674886, 1838371, 1535735, 1662382, 1705647, 1746421, 1813989, 1815527, 1828105, 1826235 |
Implement stringent validation and pre-issuance linting; ensure that any abbreviations used are correct; cross-check with multiple authoritative databases; sanitize internal lookup databases; ensure correct domain name registrant's organization name is placed in the certificate; prevent placement of organization information in DV certificates; test system changes; automate lookups and reduce human error; do not rely on CSRs for organization information; |
| Incorrect Address Fields | Automate address validation and reduce human involvement that leads to typos, etc.; cross-check with multiple authoritative databases; prevent placement of organization information in DV certificates; sanitize internal lookup databases; do not rely on CSRs for organization information; implement tools that verify locality, state, and country combinations; do not allow the pass-through of default/filler data into the certificate; use the correct abbreviations for geographic locations; |
| Insufficient Domain Validation | |
| Improper Use of Domain Validation Methods (Issuance of Certificates for Unregistered Domains) | Enforce use of approved methods; eliminate potential for human error; regularly update CP and CPS with allowed methods; use proper Random Values; do not use look-ups to external resources that are subject to attack; |
| CAA-based Misissuances
Keyword: CAA |
Automate and do not bypass CAA record checks; keep CAA verification logic up to date; communicate CAA checking requirements clearly to developers; run CAA checks immediately before certificate issuance (to avoid TTL issues with CAA records); check all domains to be contained in the certificate |
| Failure to Revoke and Revocation Delays | |
| Delayed Revocations
Whiteboard search: leaf |
Automated revocation systems; improved incident response procedures; reduced mis-issuance (see rows above), including pre-issuance linting, thorough review of certificate profiles, improved validation, etc. |
| Disclosure/Reporting Failures | |
| Delayed, Incomplete, or Failed Disclosure of Intermediate CA Certificates in the CCADB | Ensure coverage; provide training on CCADB tasks, especially on staff turnover; use automated tools for timely disclosure; include CCADB disclosure in key ceremony procedures; cross-reference internal databases with information in the CCADB; conduct regular audits; monitor the activity of external intermediate/subordinate CAs; |
| Failure to Respond to CA Survey
Summary search string: Survey |
Make sure emails are received; keep CCADB updated with communication group email addresses; provide training; document procedures; prioritize responses to root programs; set deadlines in calendaring systems |
| CRL and OCSP Failures | |
| Unavailable CRLs and OCSP Service Outages | Deploy high-availability solutions on redundant systems; publish to CDNs; continuous monitoring and alerts; monitor on https://sslmate.com/labs/crl_watch/ and https://sslmate.com/labs/ocsp_watch/; make sure CRLs have the correct names and match what is in certificates; |
| Incorrect OCSP Responses | Update CA software; perform QA testing; monitor performance of internal systems; regularly check https://sslmate.com/labs/ocsp_watch/; ensure that OCSP responses are provided for pre-certificates; |
| Expired or Invalid CRLs | Implement automated CRL management; validate CRL profiles against CABF and root program requirements; |
| Mismatch Between CA SubjectDN and CRL Issuer SubjectDN
Bug #s 1888371, |
Implement consistency checks and ensure that CRL issuer matches CA subject byte-for-byte; monitor on https://sslmate.com/labs/crl_watch/; |
| Policy and Practice Failures | |
| Failure to Publish Annual CP or CPS Updates
Bug #s 1565494, 1769222 Summary search string: annual cps update |
Schedule regular updates; involve stakeholders in review process; ensure adequate staffing; |
| Mistakes and erroneous information in CP or CPS | Update CP/CPS to address CABF and root program changes to requirements (e.g. domain validation methods); implement validation processes for CP/CPS updates; conduct regular CP/CPS reviews that also checks operational behaviors (e.g. CRL issuance frequency); double-check certificate profiles published in CP/CPS; conduct peer reviews before CP/CPS publication; include CP/CPS review in operational change processes (whenever a proposed code change will introduce or change a feature); |
| Delayed Responses to Certificate Problem Reports (CPRs) | Establish clear response time policies; use email distribution lists; designate a sufficient number of responsible individuals to answer CPRs; use automated ticketing systems; update CCADB records as soon as changes occur; |
| Audit Issues, Delays, and Failures | |
| Delayed Audit Statements
Whiteboard label: audit-delay |
Implement strict audit scheduling; use calendaring, monitoring and alerting; enter into engagement letters with auditors well ahead of the planned audit dates; develop contingency plans to address potential delays, disruptions, or auditor unavailability; gather documentation in advance of audit; follow up with auditor on expected delivery of audit letter; |
| Audit Letter Validation Failures
Summary search string: ALV |
Follow all guidance on the CCADB website, including https://www.ccadb.org/cas/alv; |
| Missing CAs in Audit Letters
Whiteboard label:audit-failureSummary search string:intermediate |
Include all intermediate and cross-certified CAs “capable of issuing” the particular kind of end entity certificate covered by the audit (TLS Capable, S/MIME Capable, etc.); use the 7MB All CA Certificates CSV list to identify all CA certificates that are “capable” of such issuance; communicate audit letter requirements to your auditor; |
| Auditor Qualifications
Whiteboard label: auditor-compliance |
Ensure auditors are qualified and certified; review the Mozilla wikipage on Auditor Qualifications; |
| Test Certificates | |
| Test Website Certificates
Summary search string: test website |
Implement certificate management tools; and calendaring for replacing the certificates used on test websites; regularly check for certificate expiration for “valid” and “revoked” certificates; provide training; |
| Issuance of Test Certificates
Summary search string: test certificate |
Use PKI hierarchies that are not publicly trusted or complete all validation and other pre-issuance steps for the test certificate; |
| Internal Security Issues | |
| Logging Issues
Summary search string: log |
Implement robust log management systems; log to a separate log server; leverage “big data” solutions; freeze operations if logging is not working; monitor logs in real-time with solutions that provide alerting and data analysis; regularly audit system logs; |
| Improper Access Control
Summary search string: access |
Establish and follow strict access control policies; conduct regular reviews of access control lists; |