3 ms·
It depends. Some ask a payment others don't. They generally require an audit of the CA which is what is charged for. The audit is preferably done by an independ
by chmike 16y ago
It depends. Some ask a payment others don't. They generally require an audit of the CA which is what is charged for. The audit is preferably done by an independent company specialize in such activity.
CACert provide free certificates and are trying hard to get their root CA certificate approved. By the time it takes I assume it is very difficult.
- sr3d 16y agoDo you know any details about the auditing process that the independent company would perform of a CA? Since the whole signing SSL business is built around keeping a 256-byte or so private key private then this file would probably be protected pretty well.
- viraptor 16y agoHave a look at http://wiki.cacert.org/InclusionStatus http://wiki.cacert.org/InclusionStatus and follow the links in comments. There's a lot of information about different audits done and planned, lists of rules, discussions about what happened in the past, etc. Direct link to Mozilla rules is http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/
- morgs 16y agoIt's the WebTrust audit for Certification Authorities: http://www.webtrust.org/certauth_fin.htm http://www.webtrust.org/certauth_fin.htm (warning: PDF)
- morgs 16y agoComplying with the audit is costly - both in direct costs to the auditors, and in implementing the infrastructure and policies and procedures to pass the audit.