Re: FNMT Root Inclusion Request
On 1/19/16 12:18 PM, Kathleen Wilson wrote:
On 1/15/16 4:42 AM, rafa...@gmail.com wrote:
Hi all.
We have developed a solution plan for this issues.
I believe that some of the concerns that were raised have been resolved,
and that the remaining open concerns are as follows. Please reply if I
missed any other items that still need to be resolved.
1) This root certificate has subordinate certificates that are not
technically constrained and not audited/disclosed according to sections
8-10 of Mozilla's CA Certificate Policy. The noted subCAs are "AC FNMT
Usuarios" (doesn't issue server certificates) and "ISA CA" (server
certificates are issued exclusively to a very restricted (almost
private) environment). Unless there are technical constraints on the
intermediate CA certificates representing those subCAs which make it
impossible for them to issue TLS or S/MIME certificates, they are
in-scope for this inclusion request, because they are a potential source
of mis-issuance which puts users of the Mozilla trust store at risk.
We are going to audit in-scope CAs. Finally our FNMT-RCM CAs hierarchy
audit scheme will be as follows:
+ AC RAIZ FNMT-RCM
+ AC Administración Pública
- Issues: SSL certs, QCP certs
- Audits: WebTrust for CAs, WebTrust SSL BRs, ETSI 101 456
+ AC Componentes Informáticos
- Issues: SSL certs
- Audits: WebTrust for CAs, WebTrust SSL BRs
+ AC FNMT Usuarios
- Issues: issues QCP certs, not restricted by EKU extension
- Audits: (ETSI 101 456 or WebTrust for CAS) and audit of
non-existence of SSL certs
+ ISA CA Will be revoked in early 2016
+ AC APE No longer used. Will be revoked in early 2016
As you can see, the two subCAs in-scope will be audited ("AC Usuarios)
and revoked ("ISA CA"). Also, "AC APE" which is no longer used will be
revoked
2) The allowed methods of verifying domain name ownership/control must
be in compliance with section 3.2.2.4 of version 1.3 (or later) of the
Baseline Requirements.
ISA CA is going to be revoked.
With this audit scheme, the remaining open issues would be solved.
I think this approach is reasonable, because I think the additional
annual audit check to ensure the AC FNMT Usuarios intermediate has not
issued SSL certs meets the intention of Mozilla's Policy and the BRs.
Does anyone see any problems with this approach?
Thanks,
Kathleen
Should I interpret the non-response to mean that everyone is OK with
this approach?
Kathleen
___
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy
Re: More SHA-1 certs
On 02/05/16 21:14, Ben Wilson wrote: > Aren't all of these CA certificates? The links in the '#' column are to lists of BR-noncompliant certificates; the links in the 'Issuer Name' column are to information about the issuing DN+public key of those certificates. > > -Original Message- > From: dev-security-policy > [mailto:dev-security-policy-bounces+ben=digicert@lists.mozilla.org] On > Behalf Of martin.suc...@gmail.com > Sent: Friday, February 5, 2016 1:13 PM > To: mozilla-dev-security-pol...@lists.mozilla.org > Subject: Re: More SHA-1 certs > > Here's a list of all certificates with SHA-1 signatures and notBefore >= > 2016-01-01, logged in the Certificate Transparency Log: > https://crt.sh/?cablint=211&minNotBefore=2016-01-01 > ___ > dev-security-policy mailing list > dev-security-policy@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-security-policy > ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
Re: More SHA-1 certs
On 02/05/16 20:13, martin.suc...@gmail.com wrote: > Here's a list of all certificates with SHA-1 signatures and notBefore >= > 2016-01-01, logged in the Certificate Transparency Log: > https://crt.sh/?cablint=211&minNotBefore=2016-01-01 Some notes on how these look as of now. The listed subCA CNs are: - DOD CA-28 - DOD CA-27 These chain to DST ACES CA X6, see https://bugzilla.mozilla.org/show_bug.cgi?id=1037590#c21 and https://cabforum.org/pipermail/public/2016-February/006696.html - Intel External Basic Issuing CA 3A These chain through a technically constrained subordinate CA https://crt.sh/?id=1250505 - Symantec Private SSL SHA1 CA These chain to the 1024-bit VeriSign roots 'Class 3 Public Primary Certification Authority' and 'Class 3 Public Primary Certification Authority - G2' which are no longer included in Mozilla's root program. Curiously, the similar COMODO CA 'COMODO Domain Validation Legacy Server CA 2' (chains to retired root 'UTN - DATACorp SGC') appears to be exempted from listing? (example cert: https://crt.sh/?id=12584167&opt=cablint) - VeriSign Class 3 Secure Server CA - G3 - VeriSign Class 3 International Server CA - G3 I believe these are the certs at https://cabforum.org/pipermail/public/2016-January/006519.html or precertificates for them. - RSA Corporate Server CA v2 - DnB NOR ASA PKI Class G - Shared Business CA 3 - TI Trust Technologies Global CA - Postecom CS3 - Aetna Inc. Certificate Authority - SHECA - AC Infrastructure - YourNet SSL for business - Verizon Public SureServer CA G14-SHA1 These have been mentioned here previously. ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
RE: More SHA-1 certs
Also, aren't they issued prior to January 1, 2016? -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+ben=digicert@lists.mozilla.org] On Behalf Of Ben Wilson Sent: Friday, February 5, 2016 2:15 PM To: martin.suc...@gmail.com; mozilla-dev-security-pol...@lists.mozilla.org Subject: RE: More SHA-1 certs Aren't all of these CA certificates? -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+ben=digicert@lists.mozilla.org] On Behalf Of martin.suc...@gmail.com Sent: Friday, February 5, 2016 1:13 PM To: mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: More SHA-1 certs Here's a list of all certificates with SHA-1 signatures and notBefore >= 2016-01-01, logged in the Certificate Transparency Log: https://crt.sh/?cablint=211&minNotBefore=2016-01-01 ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy smime.p7s Description: S/MIME cryptographic signature ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
RE: More SHA-1 certs
Aren't all of these CA certificates? -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+ben=digicert@lists.mozilla.org] On Behalf Of martin.suc...@gmail.com Sent: Friday, February 5, 2016 1:13 PM To: mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: More SHA-1 certs Here's a list of all certificates with SHA-1 signatures and notBefore >= 2016-01-01, logged in the Certificate Transparency Log: https://crt.sh/?cablint=211&minNotBefore=2016-01-01 ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy smime.p7s Description: S/MIME cryptographic signature ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
Re: More SHA-1 certs
Here's a list of all certificates with SHA-1 signatures and notBefore >= 2016-01-01, logged in the Certificate Transparency Log: https://crt.sh/?cablint=211&minNotBefore=2016-01-01 ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
