{"id":2529,"date":"2019-12-11T07:37:18","date_gmt":"2019-12-11T15:37:18","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2529"},"modified":"2019-12-11T07:37:18","modified_gmt":"2019-12-11T15:37:18","slug":"announcing-version-2-7-of-the-mozilla-root-store-policy","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/","title":{"rendered":"Announcing Version 2.7 of the Mozilla Root Store Policy"},"content":{"rendered":"<p>After many months of discussion on the <a href=\"https:\/\/lists.mozilla.org\/listinfo\/dev-security-policy\">mozilla.dev.security.policy mailing list<\/a>, our <a href=\"https:\/\/www.mozilla.org\/en-US\/about\/governance\/policies\/security-group\/certs\/policy\/\">Root Store Policy<\/a> governing Certificate Authorities (CAs) that are trusted in Mozilla products has been updated. Version 2.7 has an effective date of January 1st, 2020.<\/p>\n<p>More than one dozen <a href=\"https:\/\/github.com\/mozilla\/pkipolicy\/labels\/2.7\">issues<\/a> were addressed in this update, including the following changes:<\/p>\n<ul>\n<li>Beginning on 1-July, 2020, end-entity certificates MUST include an Extended Key Usage (EKU) extension containing KeyPurposeId(s) describing the intended usage(s) of the certificate, and the EKU extension MUST NOT contain the KeyPurposeId anyExtendedKeyUsage. This requirement is driven by the issues we\u2019ve had with non-TLS certificates that are technically capable of being used for TLS. Some CAs have argued that certificates not intended for TLS usage are not required to comply with TLS policies, however it is not possible to enforce policy based on intention alone.<\/li>\n<li>Certificate Policy and Certificate Practice Statement (CP\/CPS) versions dated after March 2020 can\u2019t contain blank sections and must &#8211; in accordance with RFC 3647 &#8211; only use \u201cNo Stipulation\u201d to mean that no requirements are imposed. That term cannot be used to mean that the section is \u201cNot Applicable\u201d. For example, \u201cNo Stipulation\u201d in section 3.2.2.6 \u201cWildcard Domain Validation\u201d means that the policy allows wildcard certificates to be issued.<\/li>\n<li>Section 8 \u201cOperational Changes\u201d will apply to unconstrained subordinate CA certificates chaining up to root certificates in Mozilla\u2019s program.\u00a0 With this change, any new unconstrained subordinate CA certificates that are transferred or signed for a different organization that doesn\u2019t already have control of a subordinate CA certificate must undergo a public discussion before issuing certificates.<\/li>\n<li>We\u2019ve seen a number of instances in which a CA has multiple policy documents and there is no clear way to determine which policies apply to which certificates. Under our new policy, CAs must provide a way to clearly determine which CP\/CPS applies to each root and intermediate certificate. This may require changes to CA\u2019s policy documents.<\/li>\n<li>Mozilla already has a \u201c<a href=\"https:\/\/wiki.mozilla.org\/CA\/Forbidden_or_Problematic_Practices#Delegation_of_Domain_.2F_Email_Validation_to_Third_Parties\">required practice<\/a>\u201d that forbids delegation of email validation to third parties for S\/MIME certificates. With this update, we add this requirement to our policy. Specifically, CAs must not delegate validation of the domain part of an email address to a third party.<\/li>\n<li>We\u2019ve also added specific S\/MIME revocation requirements to policy in place of the existing unclear requirement for S\/MIME certificates to follow the BR 4.9.1 revocation requirements. The new policy does not include specific requirements on the time in which S\/MIME certificates must be revoked.<\/li>\n<\/ul>\n<p>Other changes include:<\/p>\n<ul>\n<li>Detail the permitted signature algorithms and encodings for RSA keys and ECDSA keys in sections 5.1.1 and 5.1.2 (along with a note that Firefox does not currently support RSASSA-PSS encodings).<\/li>\n<li>Add the P-521 exclusion in section 5.1 of the Mozilla policy to section 2.3 where we list exceptions to the BRs.<\/li>\n<li>Change references to \u201cPITRA\u201d in section 8 to \u201cPoint-in-Time Audit\u201d, which is what we meant all along.<\/li>\n<li>Update required minimum versions of audit criteria in section 3.1<\/li>\n<li>Formally require <a href=\"https:\/\/wiki.mozilla.org\/CA\/Responding_To_An_Incident\">incident reporting<\/a><\/li>\n<\/ul>\n<p>A comparison of all the policy changes is available <a href=\"https:\/\/github.com\/mozilla\/pkipolicy\/pull\/199\/files\">here<\/a>.<\/p>\n<p>A few of these changes may require that CAs revise their CP\/CPS(s). Mozilla will send a <a href=\"https:\/\/wiki.mozilla.org\/CA\/Communications\">CA Communication<\/a> to alert CAs of the necessary changes, and ask CAs to provide the date by which their CP\/CPS documents will be compliant.<\/p>\n<p>We have also recently updated the <a href=\"https:\/\/www.ccadb.org\/policy\">Common CA Database (CCADB) Policy<\/a> to provide specific guidance to CAs and auditors on audit statements. As a repository of information about publicly-trusted CAs, CCADB now automatically processes audit statements submitted by CAs. The requirements added in section 5.1 of the policy help to ensure that the automated processing is successful.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>After many months of discussion on the mozilla.dev.security.policy mailing list, our Root Store Policy governing Certificate Authorities (CAs) that are trusted in Mozilla products has been updated. Version 2.7 has &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/\">Read more<\/a><\/p>\n","protected":false},"author":1574,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45538,69],"tags":[],"coauthors":[320076],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Announcing Version 2.7 of the Mozilla Root Store Policy - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Wayne Thayer\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/\",\"name\":\"Announcing Version 2.7 of the Mozilla Root Store Policy - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2019-12-11T15:37:18+00:00\",\"dateModified\":\"2019-12-11T15:37:18+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Announcing Version 2.7 of the Mozilla Root Store Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a\",\"name\":\"Wayne Thayer\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/9d66cb7b8ff76e006a6f0af6fa7d949a\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g\",\"caption\":\"Wayne Thayer\"},\"sameAs\":[\"https:\/\/x.com\/wthayer\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Announcing Version 2.7 of the Mozilla Root Store Policy - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/","twitter_misc":{"Written by":"Wayne Thayer","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/","url":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/","name":"Announcing Version 2.7 of the Mozilla Root Store Policy - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2019-12-11T15:37:18+00:00","dateModified":"2019-12-11T15:37:18+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2019\/12\/11\/announcing-version-2-7-of-the-mozilla-root-store-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Announcing Version 2.7 of the Mozilla Root Store Policy"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/e9d30f6a04fd425b92ce414efb490f7a","name":"Wayne Thayer","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/9d66cb7b8ff76e006a6f0af6fa7d949a","url":"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2bd1ca829153b238eca5f4da201857f9?s=96&d=identicon&r=g","caption":"Wayne Thayer"},"sameAs":["https:\/\/x.com\/wthayer"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2529"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1574"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2529"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2529\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2529"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}