search

mozilla / pkipolicy

Documents for Mozilla's PKI policies - certificate root program, etc.
50 stars 21 forks source link

Ban forward- and post- dating of certificates #141

Open wthayer opened 6 years ago

wthayer commented 6 years ago

Consider requiring leaf TLS certificates to appear in a CT log within some reasonably short window of time around the notBefore date.

sleevi commented 6 years ago

That’s been a anti-goal of Google’s CT requirement. Organizations that are sensitive to the accidental disclosure of upcoming products would not embed SCTs, and instead use OCSP Stapling or TLS extension.

They would test within their organization prior to their announcement (e.g. using enterprise policies) and then, once announced, include the SCTs.

I do not thing CT should be the means of enforcing this policy. If a policy is created, it should be done in a way that is auditable by auditors, rather than couples to CT.

sleevi commented 6 years ago

I suppose I should also note that one possible way of achieving that auditable property - and ensuring clients have sufficient information - is the expression of the "earliest validation date" of the data within the certificate. Thus, even if a CA pre- or post-dates, client software will have an accurate timestamp as to when the CA most recently comprehensively validated the information expressed therein.