/u/wolrah's links[0] are a great place to start reading up on this. A root CA intending to distribute SSL certificates will have to adhere to all of the CA/Brow

/u/wolrah's links[0] are a great place to start reading up on this. A root CA intending to distribute SSL certificates will have to adhere to all of the CA/Browser Forum requirements documents, plus the additional requirements imposed by each of the browsers for entry into their individual trust stores (the Apple/Google/Mozilla/Microsoft links included). To do this, you'll need to stand up an offline root CA in a secure location, then create an issuing CA that will issue certificates. That whole thing must be created ab initio in compliance with the requirements and be operated in compliance at all times. To demonstrate that, you'll then need to pay an outside, accredited audit firm to come in and attest that you're following the rules. They issue an attestation letter stating that they reviewed your operations and your assertion that you're following the rules is valid for the period of time you state: basically, you operate the CA for a period of time, then they come in and review your evidence for that period of time that shows you're doing the right things. The smallest they'll usually feel comfortable doing that for is typically sixty days, although you can get what's called a Point In Time audit that says "they were doing the right thing at this specific moment". Those audits will cover both the WebTrust for Certificate Authorities[1] requirements and the WebTrust for Certificate Authorities — SSL Baseline with Network Security requirements[2]. They overlap, but they're two separate attestation letters with two separate seals, for which you'll pay somewhere in the neighborhood of $75k-$100k for a root CA and its issuing CA. Once you have your audits in hand, you can apply to each of the trust stores for admission through the Common CA Database[3] that all of the trust stores are slowly gravitating towards. You'll have to supply all of your paperwork, the audit letter URLs, and all of the information about your CA for their deliberation. The requirements (in particular the CA/Browser Forum reqs that are encompassed in the WebTrust with SSL Baseline) have some specifics around uptime, regular operations, separation of duties, and validation of security, so this is definitely a very full-time occupation: once it's going, you can't ever stop it or lose vigilance, or you risk losing your audit. Lose your audit, and you'll be pushed out of the browser stores. [0] https://news.ycombinator.com/item?id=17390183 https://news.ycombinator.com/item?id=17390183 [1] http://www.webtrust.org/principles-and-criteria/docs/item85228.pdf http://www.webtrust.org/principles-and-criteria/docs/item852... [2] http://www.webtrust.org/principles-and-criteria/docs/item85437.PDF http://www.webtrust.org/principles-and-criteria/docs/item854... [3] https://ccadb.org https://ccadb.org