{"id":2291,"date":"2018-01-29T16:05:15","date_gmt":"2018-01-30T00:05:15","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2291"},"modified":"2018-01-29T16:05:15","modified_gmt":"2018-01-30T00:05:15","slug":"january-2018-ca-communication","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/","title":{"rendered":"January 2018 CA Communication"},"content":{"rendered":"

Mozilla has sent a CA Communication<\/a> to inform Certificate Authorities (CAs)<\/a> who have root certificates included in Mozilla\u2019s program<\/a> about current events related to domain validation for SSL certificates and to remind them of a number of upcoming deadlines. This CA Communication has been emailed to the Primary Point of Contact (POC)<\/a> and an email alias<\/a> for each CA in Mozilla\u2019s program, and they have been asked to respond to the following 6 action items:<\/p>\n

    \n
  1. Disclose Use of Baseline Requirements<\/a> Methods 3.2.2.4.9 or 3.2.2.4.10 for Domain Validation<\/a> – Recently discovered vulnerabilities in these methods of domain validation have led Mozilla to require CAs to disclose their use of these methods and to describe how they have mitigated these vulnerabilities.<\/li>\n
  2. Disclose Use of Methods 3.2.2.4.1 or 3.2.2.4.5 for Domain Validation<\/a> – Significant concerns were recently raised about the reliability of these methods that are defined in the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates<\/a>.<\/li>\n
  3. Disclose All Non-Technically-Constrained Subordinate CA Certificates – CAs have until April 15, 2018 to disclose all non-technically constrained subordinate CA certificates – including subordinate CA certificates that are constrained via EKU to S\/MIME but do not have Name Constraints – as required by version 2.5 of Mozilla’s Root Store Policy<\/a>.<\/li>\n
  4. Complete BR Self Assessment – Mozilla has asked all CAs to complete a Baseline Requirements Self-Assessment<\/a> by January 31, 2018, or by April 15, 2018 if an extension was requested<\/a>.<\/li>\n
  5. Update CP\/CPS to Comply with version 2.5 of Mozilla’s Root Store Policy<\/a> – In the November 2017 CA Communication<\/a>, a number of CAs indicated that their CP\/CPS does not yet comply with version 2.5 of the Mozilla Root Store Policy. The deadline for compliance has been extended to April 15, 2018.<\/li>\n
  6. Reduce SSL Certificate Validity Periods to 825 Days or Less by March 1, 2018 – On March 17, 2017, in ballot 193<\/a>, the CA\/Browser Forum set a deadline of March 1, 2018 after which newly-issued SSL certificates must not have a validity period greater than 825 days, and the re-use of validation information must be limited to 825 days.<\/li>\n<\/ol>\n

    The full action items can be read here<\/a>. Responses to the survey will be automatically and immediately published by the CCADB<\/a>.<\/p>\n

    With this CA Communication, we reiterate that participation in Mozilla\u2019s CA Certificate Program is at our sole discretion, and we will take whatever steps are necessary to keep our users safe. Nevertheless, we believe that the best approach to safeguard that security is to work with CAs as partners, to foster open and frank communication, and to be diligent in looking for ways to improve.<\/p>\n

    Mozilla Security Team<\/p>\n","protected":false},"excerpt":{"rendered":"

    Mozilla has sent a CA Communication to inform Certificate Authorities (CAs) who have root certificates included in Mozilla\u2019s program about current events related to domain validation for SSL certificates and … Read more<\/a><\/p>\n","protected":false},"author":581,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[69],"tags":[],"coauthors":[],"yoast_head":"\nJanuary 2018 CA Communication - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kathleen Wilson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/\",\"name\":\"January 2018 CA Communication - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2018-01-30T00:05:15+00:00\",\"dateModified\":\"2018-01-30T00:05:15+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"January 2018 CA Communication\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063\",\"name\":\"Kathleen Wilson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8d4547801f543f8990aecbcfc9c18eca\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g\",\"caption\":\"Kathleen Wilson\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"January 2018 CA Communication - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/","twitter_misc":{"Written by":"Kathleen Wilson","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/","url":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/","name":"January 2018 CA Communication - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2018-01-30T00:05:15+00:00","dateModified":"2018-01-30T00:05:15+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2018\/01\/29\/january-2018-ca-communication\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"January 2018 CA Communication"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/5cc0f3b46b6626ffb6e3b7c24fbf5063","name":"Kathleen Wilson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8d4547801f543f8990aecbcfc9c18eca","url":"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/faede0fc9d625b79b41f567407337db6?s=96&d=identicon&r=g","caption":"Kathleen Wilson"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2291"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/581"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2291"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2291\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2291"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}