From 89ac94810be8cdf2472a570333a3e2880dea588a Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 17 Oct 2024 13:52:14 -0300 Subject: [PATCH 01/11] Initial text: new references, 4.13 --- docs/BR.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/BR.md b/docs/BR.md index 8af1ad23..9e0b0b3f 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -561,6 +561,8 @@ The script outputs: ### 1.6.3 References +draft-ietf-acme-ari-05, Automated Certificate Management Environment (ACME) Renewal Information (ARI) Extension. A. Gable. August 2024. + ETSI EN 319 403, Electronic Signatures and Infrastructures (ESI); Trust Service Provider Conformity Assessment - Requirements for conformity assessment bodies assessing Trust Service Providers ETSI EN 319 411-1, Electronic Signatures and Infrastructures (ESI); Policy and security requirements for Trust Service Providers issuing certificates; Part 1: General requirements @@ -609,6 +611,8 @@ RFC7538, Request For Comments: 7538, The Hypertext Transfer Protocol Status Code RFC8499, Request for Comments: 8499, DNS Terminology. P. Hoffman, et al. January 2019. +RFC8555, Request for Comments: 8555, Automatic Certificate Management Environment (ACME). R. Barnes et al. March 2019. + RFC8659, Request for Comments: 8659, DNS Certification Authority Authorization (CAA) Resource Record. P. Hallam-Baker, et al. November 2019. RFC8738, Request for Comments: 8738, Automated Certificate Management Environment (ACME) IP Identifier Validation Extension. R.B.Shoemaker, Ed. February 2020. @@ -1587,6 +1591,17 @@ No stipulation. Not applicable. +## 4.13 Certificate lifecycle automation + +Effective INSERT DATE, the CA MUST describe in Section (?) of its CPS the support the CA provides for the ACME protocol (including the ARI extension), or equivalent, allowing client software to automate the ability to: + +1. Submit an order for a Certificate to be issued; +2. Authenticate account holders and prove control of identifiers requested in the Certificate; +3. Submit a CSR; +4. Await issuance and download the issued Certificate; +5. Request revocation; and +6. Receive CA requests for early renewal of the issued Certificate. + # 5. MANAGEMENT, OPERATIONAL, AND PHYSICAL CONTROLS The CA/Browser Forum's Network and Certificate System Security Requirements are incorporated by reference as if fully set forth herein. From e730795ea9542882e26648e02b0d8ed66d263762 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 17 Oct 2024 13:55:51 -0300 Subject: [PATCH 02/11] Update tables --- docs/BR.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 9e0b0b3f..d49368c8 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1,11 +1,14 @@ --- title: Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates -subtitle: Version 2.1.2 +subtitle: Version 2.0.X author: - CA/Browser Forum -date: 16-December-2024 +date: TBD + + + copyright: | Copyright 2024 CA/Browser Forum @@ -146,6 +149,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2.1.0 | SC76 | Clarify and improve OCSP requirements | 26-Sep-2024 | 14-Nov-2024 | | 2.1.1 | SC79 | Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate | 30-Sep-2024 | 14-Nov-2024 | | 2.1.2 | SC80 | Strengthen WHOIS lookups and Sunset Methods 3.2.2.4.2 and 3.2.2.4.15 | 7-Nov-2024 | 16-Dec-2024 | +| 2.0.X | TBD | Require disclosure of automation support | TBD | TBD | \* Effective Date and Additionally Relevant Compliance Date(s) @@ -204,7 +208,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. || TBD | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From e527e053efc600882f59bed0e1631c56f8ea752b Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 17 Oct 2024 14:00:50 -0300 Subject: [PATCH 03/11] New acronyms --- docs/BR.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/BR.md b/docs/BR.md index d49368c8..10cfabf0 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -536,8 +536,10 @@ The script outputs: | **Acronym** | **Meaning** | | --- | --- | +| ACME | Automatic Certificate Management Environment | | AICPA | American Institute of Certified Public Accountants | | ADN | Authorization Domain Name | +| ARI | ACME Renewal Information | | CA | Certification Authority | | CAA | Certification Authority Authorization | | ccTLD | Country Code Top-Level Domain | From 6265c148f22627f7795cb44ddcfc244b4b2c9dd5 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:41:32 -0400 Subject: [PATCH 04/11] Table cleanup --- docs/BR.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 10cfabf0..3e465331 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -149,7 +149,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2.1.0 | SC76 | Clarify and improve OCSP requirements | 26-Sep-2024 | 14-Nov-2024 | | 2.1.1 | SC79 | Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate | 30-Sep-2024 | 14-Nov-2024 | | 2.1.2 | SC80 | Strengthen WHOIS lookups and Sunset Methods 3.2.2.4.2 and 3.2.2.4.15 | 7-Nov-2024 | 16-Dec-2024 | -| 2.0.X | TBD | Require disclosure of automation support | TBD | TBD | +| 2.1.X | TBD | Require disclosure of automation support | TBD | TBD | \* Effective Date and Additionally Relevant Compliance Date(s) @@ -208,7 +208,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. || TBD | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | TBD | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From 67c1e3024291363c97cc0c3762c0746c4724c100 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:46:17 -0400 Subject: [PATCH 05/11] Update 4.13 date and equivalent method --- docs/BR.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 3e465331..ce84ae2e 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1599,14 +1599,16 @@ Not applicable. ## 4.13 Certificate lifecycle automation -Effective INSERT DATE, the CA MUST describe in Section (?) of its CPS the support the CA provides for the ACME protocol (including the ARI extension), or equivalent, allowing client software to automate the ability to: +Effective 2025-07-15, the CA MUST describe in Section 4.13 of its CPS the support the CA provides for the ACME protocol (including the ARI extension), or equivalent, allowing client software to automate the ability to: 1. Submit an order for a Certificate to be issued; 2. Authenticate account holders and prove control of identifiers requested in the Certificate; 3. Submit a CSR; 4. Await issuance and download the issued Certificate; 5. Request revocation; and -6. Receive CA requests for early renewal of the issued Certificate. +6. Receive CA requests for early replacement of the issued Certificate. + +Alternative automation implementations with features equivalent to ACME MAY be used by the CA (such as CMP, EST, etc.), but the capabilities of the alternative implementation MUST be described. # 5. MANAGEMENT, OPERATIONAL, AND PHYSICAL CONTROLS From 72ea7c1f62a299ab9a60fc0bc4a8cb5913490301 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:47:49 -0400 Subject: [PATCH 06/11] Date in table --- docs/BR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index ce84ae2e..d82a1a6a 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -208,7 +208,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | TBD | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From b61f8b309490bffd389d31f2bf8ec846ad399bc4 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:50:47 -0400 Subject: [PATCH 07/11] Table fix --- docs/BR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index d82a1a6a..5800b409 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -208,7 +208,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From 33356d4b80875267f8e4c81c018d048cb1d2be92 Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:52:29 -0400 Subject: [PATCH 08/11] Table fix 2 --- docs/BR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index 5800b409..8b978ed6 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -208,7 +208,7 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From d4594575616aaccc574e29217777a4cdef1bbfdf Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Thu, 9 Jan 2025 17:54:17 -0400 Subject: [PATCH 09/11] Table fix 3 --- docs/BR.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index 8b978ed6..820f5715 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -208,7 +208,8 @@ The following Certificate Policy identifiers are reserved for use by CAs to asse | 2025-03-15 | 4.3.1.2 | The CA SHALL implement a Linting process to test the technical conformity of the to-be-issued Certificate with these Requirements. | | 2025-03-15 | 8.7 | The CA SHOULD use a Linting process to test the technical accuracy of already issued Certificates against the sample set chosen for Self-Audits. | | 2025-03-15 | 3.2.2.9 | CAs MUST corroborate the results of domain validation and CAA checks from multiple Network Perspectives where specified. | -| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | | 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | +| 2025-07-15 | 3.2.2.4 | CAs MUST NOT rely on Methods 3.2.2.4.2 and 3.2.2.4.15 to issue Subscriber Certificates. | +| 2025-07-15 | 4.13 | CAs MUST document their support for ACME or equivalent automation in CPS. | ## 1.3 PKI Participants From b14cf8938ea7091491c045d3924bc96b184f8f6a Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Tue, 14 Jan 2025 16:52:15 -0400 Subject: [PATCH 10/11] Header update --- docs/BR.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 820f5715..2ac3169e 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -1,7 +1,7 @@ --- title: Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates -subtitle: Version 2.0.X +subtitle: Version 2.1.X author: - CA/Browser Forum @@ -11,7 +11,7 @@ date: TBD copyright: | - Copyright 2024 CA/Browser Forum + Copyright 2025 CA/Browser Forum This work is licensed under the Creative Commons Attribution 4.0 International license. --- From bdebfad9b6f9e19a06b2fabdea5463728867a2ff Mon Sep 17 00:00:00 2001 From: Stephen Davidson Date: Wed, 15 Jan 2025 15:58:36 -0400 Subject: [PATCH 11/11] update draft-ietf-acme-ari-05 to 07 --- docs/BR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index 2ac3169e..3a48d3c7 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -568,7 +568,7 @@ The script outputs: ### 1.6.3 References -draft-ietf-acme-ari-05, Automated Certificate Management Environment (ACME) Renewal Information (ARI) Extension. A. Gable. August 2024. +draft-ietf-acme-ari-07, Automated Certificate Management Environment (ACME) Renewal Information (ARI) Extension. A. Gable. August 2024. ETSI EN 319 403, Electronic Signatures and Infrastructures (ESI); Trust Service Provider Conformity Assessment - Requirements for conformity assessment bodies assessing Trust Service Providers