Based on the input into this discussion so far, I propose to add the
following section to the Required part of this wiki page:
https://wiki.mozilla.org/CA/Required_or_Recommended_Practices
We can consider adding text about this directly to Mozilla's Root Store
Policy later. (I'll file the request/issue in github.)
-- Proposed Text --
Section Heading: CP/CPS Structured According to RFC 3647
CP/CPS documents must be structured according to RFC 3647. This
requirement is stated in section 2.2 of the CA/Browser Forum Baseline
Requirements, with the effective of 31 May 2018. Further, CP/CPS
documents should include every component and subcomponent, and the
placement of information should be aligned with the BRs; e.g. domain
validation practices should be documented in section 3.2.2.4 of the CA’s
CP/CPS.
The words "No Stipulation" mean that the particular document imposes no
requirements related to that section.
Any CPS that falls within the scope of Mozilla’s program must not use
the words “No stipulation” unless the corresponding section in the
CA/Browser Forum Baseline Requirements state “No stipulation”, “Not
applicable”, or is blank. The words “Not applicable” are acceptable to
indicate that the CA’s policies forbid the practice that is the title of
the section. Language similar to “We do not perform <subject of the
section>” is preferred. If a full description of a section is repeated
elsewhere in the document, language similar to “Refer to Section 1.2.3”
is preferred.
Examples:
- If your CA does not allow a particular domain validation method to be
used, then the CP or CPS should say that, e.g. "This method of domain
validation is not used".
- The BRs do not allow certificate suspension, so the CA’s CPS must
state that certificate suspension is not allowed, and then the other
sections related to suspension should say “Not applicable”.
- If your CA does not issue SSL certs containing IP addresses, then
section 3.2.2.5, ‘Authentication for an IP Address’ in your CP or CPS
should say that such certificate issuance is not allowed; e.g. “No IP
address certificates are issued under this CPS.”
----
I will appreciate your constructive feedback on this.
Thanks,
Kathleen
_______________________________________________
dev-security-policy mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security-policy
