3 ms·

If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Cer

by cscott 18y ago

If you want to be a CA, you need to get Microsoft and Mozilla (among others) to include you in their list. I can't find Microsoft's policy, but Mozilla's CA Certificate Policy is here: http://www.mozilla.org/projects/security/certs/policy/ http://www.mozilla.org/projects/security/certs/policy/ There are operational requirements and management attestations that must be made such as "WebTrust Principles and Criteria for Certification Authorities".

tptacek 18y ago
WebTrust is an accounting entity; it's just a process formalism that allows companies like KPMG to "audit" CAs. I went down that rabbit hole and found the WebTrust standards document: http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&re_id=0 http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&... The technical stuff starts on page 34. The intro to the document claims that the WebTrust CA standard is loosely based on RFC2527: http://www.ietf.org/rfc/rfc2527.txt http://www.ietf.org/rfc/rfc2527.txt The technical material in these documents is about FIPS compliance for hardware crypto, key size, and backup/restore; in other words, the exact same stuff you'd read in a Common Criteria document, utterly divorced from actual operational or code security. Compare to the new PCI-DSS standard: on paper, it is actually harder to process an individual VISA card than it is to run a CA. Neither document contains the letters "M-D-5" or requires serial numbers to be randomized. However, the majority of CAs do randomize serial numbers, suggesting a best practice that simply isn't included in the industry's CA certification standard. The link you provided to the Bugzilla report on adding GeoTrust/RapidSSL is almost offensive; it reads: "we got audited by KPMG, here's our address", "ok, fill out this document", "ok, we'll add you to the next release".
- cscott 18y ago
  I'm surprised and a bit skeptical that every CA (except for one) randomizes serial numbers without it being published in a standard or guidance document somewhere. Best practice usually has something worse than a (n - 1) distribution.
  - jhancock 18y ago
    was the "one" in those articles? I didn't see. Anyway, who do you trust to buy certs from? I need to get a new one soon and would like recommendations.
    - cscott 18y ago
      What's slightly ironic is trust doesn't matter for the buyer. As long as you purchase your certificate from a CA well placed in the major browser vendors, you're good to go. Edit: Here's a list of Mozilla's included certificates: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/

by cscott 18y ago

tptacek 18y ago

WebTrust is an accounting entity; it's just a process formalism that allows companies like KPMG to "audit" CAs. I went down that rabbit hole and found the WebTrust standards document: http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&re_id=0 http://www.cica.ca/download.cfm?ci_id=45239&la_id=1&... The technical stuff starts on page 34. The intro to the document claims that the WebTrust CA standard is loosely based on RFC2527: http://www.ietf.org/rfc/rfc2527.txt http://www.ietf.org/rfc/rfc2527.txt The technical material in these documents is about FIPS compliance for hardware crypto, key size, and backup/restore; in other words, the exact same stuff you'd read in a Common Criteria document, utterly divorced from actual operational or code security. Compare to the new PCI-DSS standard: on paper, it is actually harder to process an individual VISA card than it is to run a CA. Neither document contains the letters "M-D-5" or requires serial numbers to be randomized. However, the majority of CAs do randomize serial numbers, suggesting a best practice that simply isn't included in the industry's CA certification standard. The link you provided to the Bugzilla report on adding GeoTrust/RapidSSL is almost offensive; it reads: "we got audited by KPMG, here's our address", "ok, fill out this document", "ok, we'll add you to the next release".

cscott 18y ago
I'm surprised and a bit skeptical that every CA (except for one) randomizes serial numbers without it being published in a standard or guidance document somewhere. Best practice usually has something worse than a (n - 1) distribution.
- jhancock 18y ago
  was the "one" in those articles? I didn't see. Anyway, who do you trust to buy certs from? I need to get a new one soon and would like recommendations.
  - cscott 18y ago
    What's slightly ironic is trust doesn't matter for the buyer. As long as you purchase your certificate from a CA well placed in the major browser vendors, you're good to go. Edit: Here's a list of Mozilla's included certificates: http://www.mozilla.org/projects/security/certs/included/ http://www.mozilla.org/projects/security/certs/included/